Deploy Keycloak as an OAuth provider

deploy/templates/openid/openid-admin-user.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.openid.enabled }}
+{{- if not (lookup "v1" "Secret" .Release.Namespace "openid-admin-user") }}
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "openid-admin-user"
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/resource-policy": "keep"
+type: Opaque
+data:
+  username: {{ (printf "admin@%s" (.Values.identity.realm | required "values.identity.realm is required!") | b64enc) | quote }}
+  password: {{ (printf "" | b64enc) | quote }}
+
+{{- end }}
+{{- end -}}

deploy/templates/openid/openid-ingress.yaml

@@ -0,0 +1,23 @@
+{{ if .Values.openid.enabled }}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: openid-ingressroute
+  namespace: {{ .Release.Namespace }}
+spec:
+  entryPoints:
+    - {{ .Values.acs.secure | ternary "websecure" "web" }}
+  routes:
+    - match: Host(`openid.{{.Values.acs.baseUrl | required "values.acs.baseUrl is required"}}`)
+      kind: Rule
+      services:
+        - name: openid
+          port: 80
+          namespace: {{ .Release.Namespace }}
+  {{- if .Values.acs.secure }}
+  tls:
+    secretName: {{ coalesce .Values.openid.tlsSecretName .Values.acs.tlsSecretName }}
+    domains:
+      - main: openid.{{.Values.acs.baseUrl | required "values.acs.baseUrl is required"}}
+  {{- end -}}
+{{- end -}}

deploy/templates/openid/openid.yaml

@@ -0,0 +1,89 @@
+{{ if .Values.openid.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openid
+  namespace: {{ .Release.Namespace }}
+  labels:
+    component: openid
+spec:
+  replicas: {{ .Values.openid.replicas | default 1 }}
+  selector:
+    matchLabels:
+      component: openid
+  template:
+    metadata:
+      labels:
+        component: openid
+        factory-plus.service: openid
+    spec:
+      {{- with .Values.acs.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: openid
+          image: "{{ .Values.openid.image.repository }}:{{ .Values.openid.image.tag }}"
+          imagePullPolicy: {{ .Values.openid.image.pullPolicy }}
+          args: ["start-dev", "--import-realm"]
+          env:
+            - name: KEYCLOAK_ADMIN
+              valueFrom:
+                secretKeyRef:
+                  name: openid-admin-user
+                  key: username
+            - name: KEYCLOAK_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: openid-admin-user
+                  key: password
+            - name: KC_PROXY
+              value: "edge"
+            - name: KC_HEALTH_ENABLED
+              value: "true"
+            - name: KRB5_CONFIG
+              value: /config/krb5-conf/krb5.conf
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 9000
+          volumeMounts:
+            - name: realm-config
+              mountPath: /opt/keycloak/data/import
+              readOnly: true
+            - name: krb5-conf
+              mountPath: /config/krb5-conf
+            - name: krb5-keytab
+              mountPath: /etc/keytabs
+      volumes:
+        - name: realm-config
+          configMap:
+            name: keycloak-realm-config
+        - name: krb5-conf
+          configMap:
+            name: krb5-conf
+        - name: krb5-keytabs
+          secret:
+            secretName: krb5-keytabs
+            items:
+              - path: client
+                key: sv1openid
+              - path: server
+                key: http.openid
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openid
+  namespace: {{ .Release.Namespace }}
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+  selector:
+    factory-plus.service: openid
+{{- end }}