Skip to content

feat: use Client Credentials for managing Keycloak Clients#1341

Merged
slaskawi merged 32 commits intomainfrom
pepr_keycloak_client_management
Mar 27, 2025
Merged

feat: use Client Credentials for managing Keycloak Clients#1341
slaskawi merged 32 commits intomainfrom
pepr_keycloak_client_management

Conversation

@slaskawi
Copy link
Copy Markdown
Contributor

@slaskawi slaskawi commented Mar 6, 2025 •
edited
Loading

Description

This Pull Request introduces an alternative mode for managing Keycloak Clients by the UDS Operator.

The UDS Operator now discovers if Keycloak has been properly configure (and if it supports the configuration delivered by defenseunicorns/uds-identity-config#358) and switches to Client Credentials if it does. In other case, the UDS Operator will keep using the Dynamic Client Registration feature.

The behavior might be overridden by using the PEPR_KEYCLOAK_CLIENT_STRATEGY Environment Variable in the UDS Operator that can have 3 values:

  • dynamic_client_registration - the Dynamic Client Registration mode
  • client_credentials - using the Client Credentials mode
  • auto - the Operator probes if a token obtained by the Client Credentials Grant looks good and picks proper mode according to the results of the check.

The documentation for this feature will be delivered here: #1367

Related Issue

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Steps to Validate

This functionality primarily relies on the regression testing.

Checklist before merging

slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/keycloak/chart/templates/secret-client-secrets.yaml Outdated
slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/keycloak/chart/templates/uds-package.yaml Outdated
slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/keycloak/chart/values.yaml Outdated
slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/client-secret-sync.ts Outdated
slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
slaskawi
slaskawi commented Mar 17, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
slaskawi
slaskawi commented Mar 18, 2025
View reviewed changes
Comment thread src/keycloak/chart/templates/istio-admin.yaml
@slaskawi
Client Credentials mode for managing Keycloak Clients
4a67238 
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>
@slaskawi slaskawi force-pushed the pepr_keycloak_client_management branch from 6737743 to 4a67238 Compare March 18, 2025 07:16
@slaskawi slaskawi marked this pull request as ready for review March 18, 2025 07:27
@slaskawi slaskawi requested a review from a team as a code owner March 18, 2025 07:27
@slaskawi slaskawi mentioned this pull request Mar 18, 2025
Merged
5 tasks
chance-coleman
chance-coleman reviewed Mar 18, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
chance-coleman
chance-coleman reviewed Mar 18, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
chance-coleman
chance-coleman reviewed Mar 18, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
chance-coleman
chance-coleman reviewed Mar 18, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
chance-coleman
chance-coleman reviewed Mar 18, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
This was referenced Mar 19, 2025
Closed
Closed
slaskawi and others added 2 commits March 20, 2025 20:45
@slaskawi @chance-coleman
Update docs/reference/configuration/Single Sign-On/overview.md
0ad7c9f 
Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com>
@slaskawi
Merge remote-tracking branch 'origin/main' into pepr_keycloak_client_…
77dbf38 
…management
mjnagel
mjnagel reviewed Mar 20, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/keycloak-client.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/client-secret-sync.ts Outdated
Comment thread src/pepr/operator/index.ts Outdated
Comment thread src/keycloak/chart/templates/secret-client-secrets.yaml Outdated
mjnagel
mjnagel reviewed Mar 24, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/client-secret-sync.ts
mjnagel
mjnagel reviewed Mar 24, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts
@slaskawi slaskawi mentioned this pull request Mar 25, 2025
Closed
mjnagel
mjnagel reviewed Mar 25, 2025
View reviewed changes
Comment thread docs/.images/diagrams/uds-core-pepr-operator-flow.drawio
Comment thread src/pepr/operator/controllers/keycloak/config.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/clients/dynamic-client-registration.spec.ts Outdated
Comment thread src/pepr/operator/controllers/keycloak/client-sync.ts
slaskawi and others added 5 commits March 26, 2025 07:41
@slaskawi @mjnagel
Update src/pepr/operator/controllers/keycloak/clients/dynamic-client-…
64dadea 
…registration.spec.ts

Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@slaskawi @mjnagel
Update src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts
b9cc8e5 
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@slaskawi @mjnagel
Update src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts
110d1d9 
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@slaskawi @mjnagel
Update src/pepr/operator/controllers/keycloak/clients/keycloak-client.ts
f4d21ff 
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
@slaskawi
Comments addressed
446b831
mjnagel
mjnagel reviewed Mar 26, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM at this point - validated the code with the current auto mode (using dynamic) as well as with the identity-config changes and all works as expected. Feel free to address or resolve these final comments and I will approve.

Comment thread src/pepr/operator/controllers/keycloak/config.ts Outdated
Comment thread src/pepr/uds-operator-config/values.yaml
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts Outdated
slaskawi and others added 4 commits March 27, 2025 08:38
@slaskawi slaskawi enabled auto-merge (squash) March 27, 2025 11:28
mjnagel
mjnagel reviewed Mar 27, 2025
View reviewed changes
Comment thread src/pepr/operator/controllers/keycloak/clients/client-credentials.ts Outdated
@slaskawi slaskawi merged commit 4db9cc7 into main Mar 27, 2025
25 checks passed
@slaskawi slaskawi deleted the pepr_keycloak_client_management branch March 27, 2025 15:00
@github-actions github-actions Bot mentioned this pull request Mar 26, 2025
Merged
chance-coleman pushed a commit that referenced this pull request Apr 1, 2025
@github-actions
chore(main): release 0.39.0 (#1373)
0fa1587 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
noahpb pushed a commit that referenced this pull request Apr 2, 2025
@github-actions @noahpb
chore(main): release 0.39.0 (#1373)
66af94c 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel added a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@slaskawi @chance-coleman
@noahpb @mjnagel
feat: use Client Credentials for managing Keycloak Clients (defenseun…
3a69ae1 
…icorns#1341)

## Description

This Pull Request introduces an alternative mode for managing Keycloak
Clients by the UDS Operator.

The UDS Operator now discovers if Keycloak has been properly configure
(and if it supports the configuration delivered by
defenseunicorns/uds-identity-config#358) and
switches to Client Credentials if it does. In other case, the UDS
Operator will keep using the Dynamic Client Registration feature.

The behavior might be overridden by using the
`PEPR_KEYCLOAK_CLIENT_STRATEGY` Environment Variable in the UDS Operator
that can have 3 values:

* `dynamic_client_registration` - the Dynamic Client Registration mode
* `client_credentials` - using the Client Credentials mode
* `auto` - the Operator probes if a token obtained by the Client
Credentials Grant looks good and picks proper mode according to the
results of the check.

The documentation for this feature will be delivered here:
defenseunicorns#1367

## Related Issue

* Fixes defenseunicorns#1330
* Relates to defenseunicorns#1296
* [Technical
Design](https://www.notion.so/Managing-Keycloak-Clients-from-Pepr-1a5e512f24fc80c4bc35d13b9d7a1367)

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Steps to Validate

This functionality primarily relies on the regression testing. 

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed

---------

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>
Co-authored-by: Chance <139784371+UnicornChance@users.noreply.github.com>
Co-authored-by: Noah <40781376+noahpb@users.noreply.github.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.39.0 (defenseunicorns#1373)
536fb97 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](defenseunicorns/uds-core@v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([defenseunicorns#1374](defenseunicorns#1374))
([818a3a0](defenseunicorns@818a3a0))
* ambient mesh authorization policy generation
(defenseunicorns#1384)
([b47daba](defenseunicorns@b47daba))
* new webauth and mfa flows
([defenseunicorns#1370](defenseunicorns#1370))
([1ac1b03](defenseunicorns@1ac1b03))
* theme customization
([defenseunicorns#1382](defenseunicorns#1382))
([55ef41b](defenseunicorns@55ef41b))
* use Client Credentials for managing Keycloak Clients
([defenseunicorns#1341](defenseunicorns#1341))
([4db9cc7](defenseunicorns@4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([defenseunicorns#1398](defenseunicorns#1398))
([d45b3e6](defenseunicorns@d45b3e6))
* broken selectors for internal dependencies on charts
([defenseunicorns#1403](defenseunicorns#1403))
([d72b194](defenseunicorns@d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([defenseunicorns#1379](defenseunicorns#1379))
([8200bce](defenseunicorns@8200bce))
* add docs for layer selection
([defenseunicorns#1216](defenseunicorns#1216))
([c170322](defenseunicorns@c170322))
* **deps:** update grafana
([defenseunicorns#1383](defenseunicorns#1383))
([122dc58](defenseunicorns@122dc58))
* **deps:** update grafana to v8.10.4
([defenseunicorns#1363](defenseunicorns#1363))
([fb163bd](defenseunicorns@fb163bd))
* **deps:** update istio to v1.25.0
([defenseunicorns#1335](defenseunicorns#1335))
([1803ea7](defenseunicorns@1803ea7))
* **deps:** update keycloak to v0.11.1
([defenseunicorns#1400](defenseunicorns#1400))
([6fdcd0c](defenseunicorns@6fdcd0c))
* **deps:** update keycloak to v26.1.4
([defenseunicorns#1356](defenseunicorns#1356))
([31152f7](defenseunicorns@31152f7))
* **deps:** update pepr to v0.46.3
([defenseunicorns#1365](defenseunicorns#1365))
([304a556](defenseunicorns@304a556))
* **deps:** update prometheus-stack
([defenseunicorns#1362](defenseunicorns#1362))
([ae40b27](defenseunicorns@ae40b27))
* **deps:** update prometheus-stack
([defenseunicorns#1380](defenseunicorns#1380))
([eec3337](defenseunicorns@eec3337))
* **deps:** update support dependencies to v22.13.17
([defenseunicorns#1401](defenseunicorns#1401))
([8a81eec](defenseunicorns@8a81eec))
* **deps:** update support-deps
([defenseunicorns#1364](defenseunicorns#1364))
([7819bec](defenseunicorns@7819bec))
* **deps:** update support-deps
([defenseunicorns#1376](defenseunicorns#1376))
([dd22589](defenseunicorns@dd22589))
* **deps:** update support-deps
([defenseunicorns#1390](defenseunicorns#1390))
([f06bb70](defenseunicorns@f06bb70))
* **deps:** update support-deps
([defenseunicorns#1392](defenseunicorns#1392))
([c0762a3](defenseunicorns@c0762a3))
* **deps:** update ts-jest to v29.3.0
([defenseunicorns#1377](defenseunicorns#1377))
([8b2174a](defenseunicorns@8b2174a))
* **deps:** update velero to v8.6.0
([defenseunicorns#1371](defenseunicorns#1371))
([93a44e6](defenseunicorns@93a44e6))
* remove kiali and tempo references from repo
([defenseunicorns#1375](defenseunicorns#1375))
([8374de3](defenseunicorns@8374de3))
* update how to scrape metrics
([defenseunicorns#1378](defenseunicorns#1378))
([e808f7d](defenseunicorns@e808f7d))
* update unicorn ztunnel image to 1.25.0
([defenseunicorns#1389](defenseunicorns#1389))
([7e446cb](defenseunicorns@7e446cb))


### Documentation

* velero csi vsphere backups
([defenseunicorns#1385](defenseunicorns#1385))
([5ae33b2](defenseunicorns@5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bburky bburky bburky left review comments

@mjnagel mjnagel mjnagel approved these changes

@chance-coleman chance-coleman chance-coleman approved these changes

+1 more reviewer

@noahpb noahpb noahpb left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Redesign Client Management algorithm in Pepr

5 participants

@slaskawi @bburky @mjnagel @noahpb @chance-coleman