From 15aa8be96c86628b68fe199c2991cccb3eb6db84 Mon Sep 17 00:00:00 2001 From: Deep Koluguri Date: Fri, 29 May 2026 15:08:20 -0400 Subject: [PATCH] chore: add keycloak deployment, custom theme, and apisix ingress routing config --- k8s/keycloak.yaml | 180 ++++++++++++++++++ k8s/keycloak/Dockerfile | 9 + .../theme/curaflow/login/css/styles.css | 26 +++ .../theme/curaflow/login/theme.properties | 3 + k8s/strip-hsts.yaml | 20 ++ 5 files changed, 238 insertions(+) create mode 100644 k8s/keycloak.yaml create mode 100644 k8s/keycloak/Dockerfile create mode 100644 k8s/keycloak/theme/curaflow/login/css/styles.css create mode 100644 k8s/keycloak/theme/curaflow/login/theme.properties create mode 100644 k8s/strip-hsts.yaml diff --git a/k8s/keycloak.yaml b/k8s/keycloak.yaml new file mode 100644 index 0000000..753bbf0 --- /dev/null +++ b/k8s/keycloak.yaml @@ -0,0 +1,180 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: keycloak-theme + namespace: keycloak +data: + theme.properties: | + parent=keycloak + import=common/keycloak + styles=css/styles.css + styles.css: | + body { + background-color: #f8fafc; + font-family: 'Inter', sans-serif; + } + .login-pf body { + background: #f8fafc; + } + .card-pf { + box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1); + border-radius: 8px; + border-top: 4px solid #0F172A; + } + .btn-primary { + background-color: #0F172A !important; + border-color: #0F172A !important; + } + .btn-primary:hover { + background-color: #1E293B !important; + } + #kc-header-wrapper { + color: #0F172A; + font-weight: 700; + font-family: 'Outfit', sans-serif; + text-transform: uppercase; + letter-spacing: 1px; + } +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: keycloak-db + namespace: keycloak +spec: + serviceName: keycloak-db + replicas: 1 + selector: + matchLabels: + app: keycloak-db + template: + metadata: + labels: + app: keycloak-db + spec: + containers: + - name: postgres + image: postgres:15 + env: + - name: POSTGRES_DB + value: "keycloak" + - name: POSTGRES_USER + value: "keycloak" + - name: POSTGRES_PASSWORD + value: "keycloak" + ports: + - containerPort: 5432 +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak-db + namespace: keycloak +spec: + ports: + - port: 5432 + selector: + app: keycloak-db +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: keycloak + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - name: keycloak + image: quay.io/keycloak/keycloak:24.0.5 + args: ["start-dev"] + env: + - name: KEYCLOAK_ADMIN + value: "admin" + - name: KEYCLOAK_ADMIN_PASSWORD + value: "Mykeycloakpwd@1" + - name: KC_DB + value: "postgres" + - name: KC_DB_URL + value: "jdbc:postgresql://keycloak-db:5432/keycloak" + - name: KC_DB_USERNAME + value: "keycloak" + - name: KC_DB_PASSWORD + value: "keycloak" + - name: KC_HOSTNAME_STRICT_HTTPS + value: "false" + - name: KC_PROXY_HEADERS + value: "xforwarded" + - name: KC_HOSTNAME_URL + value: "https://sso.applaude.net/" + - name: KC_HTTP_ENABLED + value: "true" + ports: + - name: http + containerPort: 8080 + volumeMounts: + - name: theme-volume-properties + mountPath: /opt/keycloak/themes/curaflow/login/theme.properties + subPath: theme.properties + - name: theme-volume-css + mountPath: /opt/keycloak/themes/curaflow/login/css/styles.css + subPath: styles.css + volumes: + - name: theme-volume-properties + configMap: + name: keycloak-theme + items: + - key: theme.properties + path: theme.properties + - name: theme-volume-css + configMap: + name: keycloak-theme + items: + - key: styles.css + path: styles.css +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + namespace: keycloak +spec: + type: ClusterIP + ports: + - port: 8080 + targetPort: 8080 + selector: + app: keycloak +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: keycloak-ingress + namespace: keycloak + annotations: + k8s.apisix.apache.org/plugin-config-name: "strip-hsts" +spec: + ingressClassName: apisix + rules: + - host: sso.applaude.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: keycloak + port: + number: 8080 diff --git a/k8s/keycloak/Dockerfile b/k8s/keycloak/Dockerfile new file mode 100644 index 0000000..d736d48 --- /dev/null +++ b/k8s/keycloak/Dockerfile @@ -0,0 +1,9 @@ +FROM quay.io/keycloak/keycloak:24.0.5 + +# Copy custom theme +COPY theme /opt/keycloak/themes + +# Optimize Keycloak build with health endpoints and metrics +RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --metrics-enabled=true + +ENTRYPOINT ["/opt/keycloak/bin/kc.sh"] diff --git a/k8s/keycloak/theme/curaflow/login/css/styles.css b/k8s/keycloak/theme/curaflow/login/css/styles.css new file mode 100644 index 0000000..ad52bf3 --- /dev/null +++ b/k8s/keycloak/theme/curaflow/login/css/styles.css @@ -0,0 +1,26 @@ +body { + background-color: #f8fafc; + font-family: 'Inter', sans-serif; +} +.login-pf body { + background: #f8fafc; +} +.card-pf { + box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1); + border-radius: 8px; + border-top: 4px solid #0F172A; +} +.btn-primary { + background-color: #0F172A; + border-color: #0F172A; +} +.btn-primary:hover { + background-color: #1E293B; +} +#kc-header-wrapper { + color: #0F172A; + font-weight: 700; + font-family: 'Outfit', sans-serif; + text-transform: uppercase; + letter-spacing: 1px; +} diff --git a/k8s/keycloak/theme/curaflow/login/theme.properties b/k8s/keycloak/theme/curaflow/login/theme.properties new file mode 100644 index 0000000..411c733 --- /dev/null +++ b/k8s/keycloak/theme/curaflow/login/theme.properties @@ -0,0 +1,3 @@ +parent=keycloak +import=common/keycloak +styles=css/styles.css diff --git a/k8s/strip-hsts.yaml b/k8s/strip-hsts.yaml new file mode 100644 index 0000000..b5b753a --- /dev/null +++ b/k8s/strip-hsts.yaml @@ -0,0 +1,20 @@ +apiVersion: apisix.apache.org/v2 +kind: ApisixPluginConfig +metadata: + name: strip-hsts + namespace: keycloak +spec: + plugins: + - name: proxy-rewrite + enable: true + config: + headers: + X-Forwarded-Proto: "https" + X-Forwarded-Port: "443" + - name: response-rewrite + enable: true + config: + headers: + Strict-Transport-Security: "" + X-Frame-Options: "" + Content-Security-Policy: "frame-src *; frame-ancestors *; object-src 'none';"