DOCSEARCHbyAlgolia
Submit Docs

codecentric Helm Charts

repository·master·Indexed 20 days ago

https://github.com/codecentric/helm-charts

A collection of curated Helm charts maintained by codecentric, available via a standard Helm repository and as OCI artifacts in the GitHub Container Registry. This includes charts for Keycloak, with a specific legacy Wildfly-based Keycloak chart and a recommended Keycloak-X chart for current and new installations.

Tokens
21.2K
Snippets
60
Records
102
Agent score
73%

What's inside codecentric-helm-charts

  2. How the `tpl` function works in Keycloak configuration

    master

    The chart uses the Helm tpl function for several configuration keys. This allows you to pass string values from values.yaml through the templating engine, enabling dynamic values (like using {{ .Values.someKey }} or {{ include "keycloak.fullname" . }}) within your configuration.

    Important: These values must be configured as strings in your values.yaml, otherwise the installation will fail.

    Supported keys using tpl:

    • extraInitContainers
    • extraContainers
    • extraEnv
    • extraEnvFrom
    • affinity
    • extraVolumeMounts
    • extraVolumes
    • livenessProbe
    • readinessProbe
    • startupProbe
    • topologySpreadConstraints
    • Custom labels and annotations on various resources.

  3. Configure High Availability and Clustering

    master

    For High Availability (HA), set replicas > 1.

    Cache Stacks:

    • Default (Recommended): Since Keycloak 26.1.0, the default is jdbc-ping, which uses a jgroups_ping table in the database. This reduces network complexity and works well across cloud providers.
    • Legacy Kubernetes Stack: If you require the original kubernetes stack, set cache.stack: custom and add the following environment variables:
    extraEnv: |
  - name: KC_CACHE
    value: "ispn"
  - name: KC_CACHE_STACK
    value: "kubernetes"
  - name: JAVA_OPTS_APPEND
    value: >-
      -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless

    Custom Service Discovery: To use a custom Infinispan configuration file (e.g., cache-custom.xml), set cache.stack: custom and provide the file via the KC_CACHE_CONFIG_FILE environment variable. The file must be available at /opt/keycloak/conf/cache-custom.xml inside the container.

    cache:
  stack: custom

  6. Enable WildFly metrics for Prometheus

    master

    WildFly can expose metrics on the management port. To enable this, you must set the KEYCLOAK_STATISTICS environment variable to all via extraEnv.

    If you are using the prometheus-operator, enable the serviceMonitor to automatically create a ServiceMonitor resource. If you are not using the operator, add Prometheus scrape annotations to the service configuration.

    # Enable metrics via environment variable
extraEnv: |
  - name: KEYCLOAK_STATISTICS
    value: all

# Enable ServiceMonitor for prometheus-operator
serviceMonitor:
  enabled: true

  7. Install the Keycloak Helm Chart

    master

    You can install the Keycloak chart using either CLI arguments with --set or a YAML values file.

    Using CLI arguments:

    helm install keycloak codecentric/keycloak -n keycloak --set replicas=1

    Using a values file:

    helm install keycloak codecentric/keycloak -n keycloak --values values.yaml
    #!/bin/bash
helm install keycloak codecentric/keycloak -n keycloak --set replicas=1

  9. Access the Keycloak Admin Console

    master

    After deploying Keycloak, you can access the Admin Console by forwarding the HTTP service port to your local machine.

    1. Run the port-forward command: kubectl port-forward service/keycloak-keycloakx-http 8080:80
    2. Open your browser to: http://localhost:8080/auth
    3. Use the following default credentials:
      • Username: admin
      • Password: secret
    kubectl port-forward service/keycloak-keycloakx-http 8080:80

  10. Restrict access to Keycloak Metrics SPI endpoint via Ingress-Nginx

    master

    Since the Keycloak Metrics SPI endpoint is exposed on the public HTTP port, you may want to restrict access using your ingress controller. For ingress-nginx, you can use a server-snippet annotation to return a 403 Forbidden for the metrics path.

    annotations:
  nginx.ingress.kubernetes.io/server-snippet: |
    location ~* /auth/realms/[^/]+/metrics {
        return 403;
    }

  11. Set up Keycloak.X with PostgreSQL using CloudNative-PG

    master

    This guide demonstrates how to deploy Keycloak.X configured to use a PostgreSQL database managed by the CloudNative-PG operator. The process involves adding the necessary Helm repositories, deploying the database cluster via Kubernetes manifests, and then installing Keycloak using the codecentric/keycloakx chart with custom values.

    # 1. Add repositories
helm repo add cnpg https://cloudnative-pg.github.io/charts
helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo update

# 2. Deploy PostgreSQL database
kubectl apply -f keycloak-cluster.yaml
kubectl wait -for=condition=Ready cluster/keycloak-database --timeout=300s

# 3. Deploy Keycloak
helm install keycloak codecentric/keycloakx --values ./keycloak-server-values.yaml