feat: Configurable Infinispan Replication, Load shedding, Threads Management and DB credentials via secrets

charts/keycloakx/examples/infinispan-jdbcping/keycloak-cluster.yaml

@@ -0,0 +1,13 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: keycloak-db
+  namespace: keycloak
+spec:
+  instances: 3
+  storage:
+    size: 5Gi
+  bootstrap:
+    initdb:
+      database: keycloak
+      owner: keycloak

charts/keycloakx/examples/infinispan-jdbcping/keycloak-server-values.yaml

@@ -0,0 +1,81 @@
+replicas: 3
+command:
+  - "/opt/keycloak/bin/kc.sh"
+  - "--verbose"
+  - "start"
+  - "--http-port=8080"
+  - "--hostname-strict=false"
+  - "--db=postgres"
+  - "--spi-events-listener-jboss-logging-success-level=info"
+  - "--spi-events-listener-jboss-logging-error-level=warn"
+database:
+  existingSecret: "keycloak-db-credentials"
+  existingSecretKeys:
+    username: "username"
+    password: "password"
+    hostname: "host"
+    port: "port"
+    database: "database"
+    vendor: "vendor"
+cache:
+  stack: jdbc-ping
+infinispan:
+  owners:
+    sessions: 2
+    authenticationSessions: 2
+    userSessions: 2
+    offlineSessions: 2
+loadShedding:
+  enabled: true
+  httpMaxQueuedRequests: 1000
+threads:
+  http:
+    poolMaxThreads: ""
+  jgroups:
+    maxThreads: ""
+resources:
+  requests:
+    cpu: "500m"
+    memory: "1Gi"
+  limits:
+    cpu: "1000m"
+    memory: "2Gi"
+ingress:
+  enabled: true
+  ingressClassName: ""
+  rules:
+    - host: auth.example.com
+      paths:
+        - path: /auth
+          pathType: Prefix
+autoscaling:
+  enabled: false
+  minReplicas: 3
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 80
+podDisruptionBudget:
+  minAvailable: 2
+serviceMonitor:
+  enabled: false
+dbchecker:
+  enabled: true
+affinity: |
+  podAntiAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            {{- include "keycloak.selectorLabels" . | nindent 12 }}
+        topologyKey: kubernetes.io/hostname
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              {{- include "keycloak.selectorLabels" . | nindent 14 }}
+          topologyKey: topology.kubernetes.io/zone

charts/keycloakx/examples/infinispan-jdbcping/readme.md

@@ -0,0 +1,33 @@
+# Keycloak.X with JDBC Ping, Infinispan Replication and Load Shedding
+
+## Deploy Kubernetes Cluster
+
+## Deploy a PostgreSQL database
+```
+kubectl apply -f keycloak-cluster.yaml
+kubectl wait -for=condition=Ready cluster/keycloak-database --timeout=300s
+```
+
+# Deploy Keycloak
+```
+helm install keycloak . \
+     --namespace keycloak --create-namespace \
+     --values examples/infinispan-jdbc-ping/keycloak-server-values.yaml
+```
+
+# Access Keycloak
+Once Keycloak is running, forward the HTTP service port to 8080.
+
+```
+kubectl port-forward service/keycloak-keycloakx-http 8080:80
+```
+
+You can then access the Keycloak Admin-Console via `http://localhost:8080/auth` with
+username: `admin` and password: `secret`.
+
+# Remove Keycloak
+
+```
+helm uninstall keycloak
+kubectl delete -f keycloak-cluster.yaml
+```

charts/keycloakx/templates/_helpers.tpl

@@ -65,6 +65,35 @@ Create the service DNS name.
 {{ include "keycloak.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
 {{- end }}
 
+{{/*
+Get database hostname from existingSecretKeys or direct value
+*/}}
+{{- define "keycloak.databaseHostname" -}}
+{{- if .Values.database.existingSecretKeys.hostname }}
+{{- .Values.database.existingSecretKeys.hostname }}
+{{- else if .Values.database.hostname }}
+{{- .Values.database.hostname }}
+{{- else }}
+{{- fail "database hostname is required" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Get database port from existingSecretKeys or direct value
+*/}}
+{{- define "keycloak.databasePort" -}}
+{{- if .Values.database.existingSecretKeys.port }}
+{{- .Values.database.existingSecretKeys.port }}
+{{- else if .Values.database.port }}
+{{- .Values.database.port }}
+{{- else }}
+{{- fail "database port is required" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Database password environment variable handling
+*/}}
 {{- define "keycloak.databasePasswordEnv" -}}
 {{- if or .Values.database.password .Values.database.existingSecret -}}
 - name: KC_DB_PASSWORD
@@ -74,3 +103,53 @@ Create the service DNS name.
       key: {{ .Values.database.existingSecretKey | default "password" }}
   {{- end }}
 {{- end -}}
+
+{{/*
+Database credential environment variable handling from existing secret
+*/}}
+{{- define "keycloak.databaseCredentialEnv" -}}
+{{- if .Values.database.existingSecret -}}
+  {{- if .Values.database.existingSecretKeys.username }}
+- name: KC_DB_USERNAME
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.username }}
+  {{- end }}
+  {{- if .Values.database.existingSecretKeys.password }}
+- name: KC_DB_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.password }}
+  {{- end }}
+  {{- if .Values.database.existingSecretKeys.hostname }}
+- name: KC_DB_URL_HOST
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.hostname }}
+  {{- end }}
+  {{- if .Values.database.existingSecretKeys.port }}
+- name: KC_DB_URL_PORT
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.port }}
+  {{- end }}
+  {{- if .Values.database.existingSecretKeys.database }}
+- name: KC_DB_URL_DATABASE
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.database }}
+  {{- end }}
+  {{- if .Values.database.existingSecretKeys.vendor }}
+- name: KC_DB
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.database.existingSecret }}
+      key: {{ .Values.database.existingSecretKeys.vendor }}
+  {{- end }}
+{{- end -}}
+{{- end -}}

charts/keycloakx/templates/statefulset.yaml

@@ -48,13 +48,43 @@ spec:
           imagePullPolicy: {{ .Values.dbchecker.image.pullPolicy }}
           securityContext:
             {{- toYaml .Values.dbchecker.securityContext | nindent 12 }}
+          env:
+            {{- if .Values.database.existingSecret }}
+            # Read hostname from secret
+            {{- if .Values.database.existingSecretKeys.hostname }}
+            - name: DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.existingSecret }}
+                  key: {{ .Values.database.existingSecretKeys.hostname }}
+            {{- else if .Values.database.hostname }}
+            - name: DB_HOST
+              value: {{ .Values.database.hostname | quote }}
+            {{- end }}
+            # Read port from secret
+            {{- if .Values.database.existingSecretKeys.port }}
+            - name: DB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.database.existingSecret }}
+                  key: {{ .Values.database.existingSecretKeys.port }}
+            {{- else if .Values.database.port }}
+            - name: DB_PORT
+              value: {{ .Values.database.port | quote }}
+            {{- end }}
+            {{- else }}
+            - name: DB_HOST
+              value: {{ .Values.database.hostname | quote }}
+            - name: DB_PORT
+              value: {{ .Values.database.port | quote }}
+            {{- end }}
           command:
             - sh
             - -c
             - |
               echo 'Waiting for Database to become ready...'
 
-              until printf "." && nc -z -w 2 {{ required ".Values.database.hostname is required if dbchecker is enabled!" .Values.database.hostname }} {{ required ".Values.database.port is required if dbchecker is enabled!" .Values.database.port }}; do
+              until printf "." && nc -z -w 2 "$DB_HOST" "$DB_PORT"; do
                   sleep 2;
               done;
 
@@ -98,6 +128,16 @@ spec:
               value: "ispn"
             - name: KC_CACHE_STACK
               value: "jdbc-ping"
+            {{- else if eq .Values.cache.stack "jdbc-ping" }}
+            - name: KC_CACHE
+              value: "ispn"
+            - name: KC_CACHE_STACK
+              value: "jdbc-ping"
+            {{- end }}
+            {{- if and (eq .Values.cache.stack "jdbc-ping") .Values.cache.jgroups.config }}
+            - name: KC_CACHE_STACK_CONFIG
+              value: |
+{{ tpl .Values.cache.jgroups.config . | indent 16 }}
             {{- end }}
             {{- if .Values.proxy.enabled }}
             - name: KC_PROXY_HEADERS
@@ -107,29 +147,42 @@ spec:
             - name: KC_HTTP_ENABLED
               value: "true"
             {{- end }}
-            {{- if .Values.database.vendor }}
+            {{- if and .Values.database.vendor (not .Values.database.existingSecretKeys.vendor) }}
             - name: KC_DB
               value: {{ .Values.database.vendor }}
             {{- end }}
-            {{- if .Values.database.hostname }}
+            {{- if not .Values.database.existingSecret }}
+              {{- if .Values.database.hostname }}
             - name: KC_DB_URL_HOST
               value: {{ .Values.database.hostname }}
-            {{- end }}
-            {{- if .Values.database.port }}
+              {{- end }}
+              {{- if .Values.database.port }}
             - name: KC_DB_URL_PORT
               value: {{ .Values.database.port | quote }}
-            {{- end }}
-            {{- if .Values.database.database }}
+              {{- end }}
+              {{- if .Values.database.database }}
             - name: KC_DB_URL_DATABASE
               value: {{ .Values.database.database }}
+              {{- end }}
+              {{- if .Values.database.username }}
+            - name: KC_DB_USERNAME
+              value: {{ .Values.database.username }}
+              {{- end }}
             {{- end }}
-            {{- if .Values.database.username }}
+            {{- if .Values.database.existingSecret }}
+              {{- if not .Values.database.existingSecretKeys.username }}
+                {{- if .Values.database.username }}
             - name: KC_DB_USERNAME
               value: {{ .Values.database.username }}
+                {{- end }}
+              {{- end }}
+            {{- include "keycloak.databaseCredentialEnv" . | nindent 12 }}
             {{- end }}
             {{- if or .Values.database.password .Values.database.existingSecret -}}
+            {{- if not .Values.database.existingSecretKeys.password }}
             {{- include "keycloak.databasePasswordEnv" . | nindent 12 }}
             {{- end }}
+            {{- end }}
             {{- if .Values.metrics.enabled }}
             - name: KC_METRICS_ENABLED
               value: "true"
@@ -138,6 +191,48 @@ spec:
             - name: KC_HEALTH_ENABLED
               value: "true"
             {{- end }}
+            {{- if .Values.infinispan.owners.sessions }}
+            - name: KC_CACHE__OWNERS_SESSIONS
+              value: {{ .Values.infinispan.owners.sessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.authenticationSessions }}
+            - name: KC_CACHE__OWNERS_AUTHENTICATION_SESSIONS
+              value: {{ .Values.infinispan.owners.authenticationSessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.userSessions }}
+            - name: KC_CACHE__OWNERS_USER_SESSIONS
+              value: {{ .Values.infinispan.owners.userSessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.offlineSessions }}
+            - name: KC_CACHE__OWNERS_OFFLINE_SESSIONS
+              value: {{ .Values.infinispan.owners.offlineSessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.clientSessions }}
+            - name: KC_CACHE__OWNERS_CLIENT_SESSIONS
+              value: {{ .Values.infinispan.owners.clientSessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.offlineClientSessions }}
+            - name: KC_CACHE__OWNERS_OFFLINE_CLIENT_SESSIONS
+              value: {{ .Values.infinispan.owners.offlineClientSessions | quote }}
+            {{- end }}
+            {{- if .Values.infinispan.owners.loginFailures }}
+            - name: KC_CACHE__OWNERS_LOGIN_FAILURES
+              value: {{ .Values.infinispan.owners.loginFailures | quote }}
+            {{- end }}
+            {{- if .Values.loadShedding.enabled }}
+              {{- if .Values.loadShedding.httpMaxQueuedRequests }}
+            - name: KC_HTTP_MAX_QUEUED_REQUESTS
+              value: {{ .Values.loadShedding.httpMaxQueuedRequests | quote }}
+              {{- end }}
+            {{- end }}
+            {{- if and .Values.threads.http.poolMaxThreads (ne .Values.threads.http.poolMaxThreads "") }}
+            - name: KC_HTTP_POOL_MAX_THREADS
+              value: {{ .Values.threads.http.poolMaxThreads | quote }}
+            {{- end }}
+            {{- if and .Values.threads.jgroups.maxThreads (ne .Values.threads.jgroups.maxThreads "") }}
+            - name: KC_THREADS_MAX
+              value: {{ .Values.threads.jgroups.maxThreads | quote }}
+            {{- end }}
             {{- with .Values.extraEnv }}
             {{- tpl . $ | nindent 12 }}
             {{- end }}
@@ -236,4 +331,4 @@ spec:
   {{- with .Values.volumeClaimTemplates }}
   volumeClaimTemplates:
     {{- tpl . $ | nindent 4 }}
-  {{- end }}
+  {{- end }}