Skip to content

Commit 9c97080

Browse files
dloewen2dloewen2
authored
[keycloak] add truststoreExistingSecretKey, add truststorePassword to env-Vars (#574)
[keycloak] add truststoreExistingSecretKey value and include truststorePassword in env-vars
1 parent e5e686d commit 9c97080

File tree

6 files changed

+39
-24
lines changed

6 files changed

+39
-24
lines changed

‎charts/keycloak/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: keycloak
33
description: Open Source Identity and Access Management Solution
44
type: application
5-
version: 0.8.2
5+
version: 0.8.3
66
appVersion: "26.4.2"
77
keywords:
88
- keycloak

‎charts/keycloak/README.md‎

Lines changed: 23 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -148,28 +148,29 @@ The following table lists the configurable parameters of the Keycloak chart and
148148

149149
### TLS Configuration
150150

151-
| Parameter | Description | Default |
152-
| --------------------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------- |
153-
| `tls.enabled` | Enable TLS/HTTPS support using custom certificates | `false` |
154-
| `tls.existingSecret` | Name of existing secret containing TLS certificate and key (PEM format, keys: tls.crt, tls.key) | `""` |
155-
| `tls.certificateFile` | Path where the TLS certificate file will be mounted (internal) | `"/opt/keycloak/certs/tls.crt"` |
156-
| `tls.certificateKeyFile` | Path where the TLS certificate key file will be mounted (internal) | `"/opt/keycloak/certs/tls.key"` |
157-
| `tls.certManager.enabled` | Enable cert-manager integration for automatic certificate provisioning | `false` |
158-
| `tls.certManager.issuerRef.name` | Name of the cert-manager Issuer or ClusterIssuer | `""` |
159-
| `tls.certManager.issuerRef.kind` | Kind of the cert-manager issuer (Issuer or ClusterIssuer) | `ClusterIssuer` |
160-
| `tls.certManager.issuerRef.group` | Group of the cert-manager issuer | `cert-manager.io` |
161-
| `tls.certManager.duration` | Certificate duration (e.g., 2160h for 90 days) | `""` |
162-
| `tls.certManager.renewBefore` | Time before expiry to renew certificate (e.g., 360h for 15 days) | `""` |
163-
| `tls.certManager.commonName` | Certificate common name (defaults to first dnsName if not specified) | `""` |
164-
| `tls.certManager.dnsNames` | List of DNS names for the certificate (uses ingress.hosts if not specified) | `[]` |
165-
| `tls.certManager.ipAddresses` | List of IP addresses for the certificate | `[]` |
166-
| `tls.certManager.secretName` | Name for the generated secret (defaults to `<fullname>-tls`) | `""` |
167-
| `tls.certManager.usages` | Certificate key usages | `["digital signature", "key encipherment"]` |
168-
| `tls.certManager.annotations` | Additional annotations for the Certificate resource | `{}` |
169-
| `tls.truststoreEnabled` | Enable truststore for client certificate validation or outgoing HTTPS requests | `false` |
170-
| `tls.truststoreExistingSecret` | Name of existing secret containing truststore file (Java Keystore format, key: truststore.jks) | `""` |
171-
| `tls.truststorePassword` | Password for the truststore (use with caution - consider using existing secret) | `""` |
172-
| `tls.truststoreFile` | Path where the truststore file will be mounted (internal) | `"/opt/keycloak/truststore/truststore.jks"` |
151+
| Parameter | Description | Default |
152+
| --------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------- |
153+
| `tls.enabled` | Enable TLS/HTTPS support using custom certificates | `false` |
154+
| `tls.existingSecret` | Name of existing secret containing TLS certificate and key (PEM format, keys: tls.crt, tls.key) | `""` |
155+
| `tls.certificateFile` | Path where the TLS certificate file will be mounted (internal) | `"/opt/keycloak/certs/tls.crt"` |
156+
| `tls.certificateKeyFile` | Path where the TLS certificate key file will be mounted (internal) | `"/opt/keycloak/certs/tls.key"` |
157+
| `tls.certManager.enabled` | Enable cert-manager integration for automatic certificate provisioning | `false` |
158+
| `tls.certManager.issuerRef.name` | Name of the cert-manager Issuer or ClusterIssuer | `""` |
159+
| `tls.certManager.issuerRef.kind` | Kind of the cert-manager issuer (Issuer or ClusterIssuer) | `ClusterIssuer` |
160+
| `tls.certManager.issuerRef.group` | Group of the cert-manager issuer | `cert-manager.io` |
161+
| `tls.certManager.duration` | Certificate duration (e.g., 2160h for 90 days) | `""` |
162+
| `tls.certManager.renewBefore` | Time before expiry to renew certificate (e.g., 360h for 15 days) | `""` |
163+
| `tls.certManager.commonName` | Certificate common name (defaults to first dnsName if not specified) | `""` |
164+
| `tls.certManager.dnsNames` | List of DNS names for the certificate (uses ingress.hosts if not specified) | `[]` |
165+
| `tls.certManager.ipAddresses` | List of IP addresses for the certificate | `[]` |
166+
| `tls.certManager.secretName` | Name for the generated secret (defaults to `<fullname>-tls`) | `""` |
167+
| `tls.certManager.usages` | Certificate key usages | `["digital signature", "key encipherment"]` |
168+
| `tls.certManager.annotations` | Additional annotations for the Certificate resource | `{}` |
169+
| `tls.truststoreEnabled` | Enable truststore for client certificate validation or outgoing HTTPS requests | `false` |
170+
| `tls.truststoreExistingSecret` | Name of existing secret containing truststore file (Java Keystore format, default-key: truststore.jks) | `""` |
171+
| `tls.truststoreExistingSecretKey` | Key of the secret to get the trustStorePassword from | `"truststore.jks"` |
172+
| `tls.truststorePassword` | Password for the truststore (use with caution - consider using existing secret) | `""` |
173+
| `tls.truststoreFile` | Path where the truststore file will be mounted (internal) | `"/opt/keycloak/truststore/truststore.jks"` |
173174

174175
### Database Configuration
175176

‎charts/keycloak/templates/deployment.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,13 @@ spec:
138138
secretKeyRef:
139139
name: {{ include "keycloak.secretName" . }}
140140
key: {{ include "keycloak.adminPasswordKey" . }}
141+
{{- if or .Values.tls.truststorePassword .Values.tls.truststoreExistingSecret }}
142+
- name: KC_HTTPS_TRUST_STORE_PASSWORD
143+
valueFrom:
144+
secretKeyRef:
145+
name: {{ .Values.tls.truststoreExistingSecret | default (include "keycloak.fullname" .) }}
146+
key: {{ .Values.tls.truststoreExistingSecretKey }}
147+
{{- end }}
141148
{{- if .Values.database.type }}
142149
- name: KC_DB
143150
value: {{ .Values.database.type }}

‎charts/keycloak/templates/secret.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ metadata:
1313
type: Opaque
1414
data:
1515
admin-password: {{ (.Values.keycloak.adminPassword | default (randAlphaNum 32)) | b64enc | quote }}
16+
{{- if .Values.tls.truststorePassword }}
17+
{{ .Values.tls.truststoreExistingSecretKey }}: {{ .Values.tls.truststorePassword | b64enc }}
18+
{{- end }}
1619
{{- end }}
1720
---
1821
{{- if and (not .Values.database.existingSecret) (or (eq .Values.database.type "postgres") (eq .Values.database.type "mysql") (eq .Values.database.type "mariadb")) }}

‎charts/keycloak/templates/service.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,6 @@ spec:
2626
{{- end }}
2727
selector:
2828
{{- include "keycloak.selectorLabels" . | nindent 4 }}
29+
{{- if .Values.service.trafficDistribution }}
2930
trafficDistribution: {{ .Values.service.trafficDistribution }}
31+
{{- end }}

‎charts/keycloak/values.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,10 @@ tls:
161161
## @param tls.truststoreEnabled Enable truststore for client certificate validation or outgoing HTTPS requests
162162
truststoreEnabled: false
163163
## @param tls.truststoreExistingSecret Name of existing secret containing truststore file (Java Keystore format)
164-
## The secret should contain 'truststore.jks' key
164+
## The secret should contain 'truststore.jks' key or the key specified in the value 'tls.truststoreExistingSecretKey'
165165
truststoreExistingSecret: ""
166+
## @param tls.truststoreExistingSecretKey Key of the secret to get the trustStorePassword from
167+
truststoreExistingSecretKey: "truststore.jks"
166168
## @param tls.truststorePassword Password for the truststore (use with caution - consider using existingSecret)
167169
truststorePassword: ""
168170
## @param tls.truststoreFile Path where the truststore file will be mounted (internal)

0 commit comments

Comments
 (0)