feat(delve): Implement Phase 3 - Keycloak OIDC SSO and internal TLS re-encrypt

- Added OIDC configuration options in group_vars and defaults.
- Created tasks for provisioning internal TLS certificates and configuring Keycloak OIDC client.
- Updated deployment and Helm chart templates to support OIDC and TLS.
- Enhanced README with details on OIDC integration and its phases.
- Modified OpenBao ACL policies to include OIDC paths.
- Introduced new templates for VaultStaticSecret to sync OIDC credentials.
- Updated integration plan documentation to reflect Phase 3 implementation.

Author: iLoveTux

ansible/inventories/development/group_vars/all.yml

@@ -58,6 +58,7 @@ delve_vso_sa_name: delve-vso
 delve_openbao_policy_name: delve-vso
 delve_openbao_k8s_role: delve-vso
 delve_openbao_db_path: delve/db
+delve_openbao_oidc_path: delve/oidc
 
 # Toggle for the delve role (mirrors keycloak_enabled). Default on for dev.
 delve_enabled: true

ansible/roles/delve/README.md

@@ -1,10 +1,12 @@
 # delve
 
 Deploys the [Delve](https://github.com/McIndi/delve) audit-search platform
-(Django 5 + DRF) into the armory cluster. This is **Phase 1** of the
-[Delve audit-search integration plan](../../../doc/handoffs/delve-audit-integration-plan.md):
-Delve running on Postgres at `https://delve.armory.local`, authenticating with a
-local Django superuser. Keycloak SSO and machine ingestion land in later phases.
+(Django 5 + DRF) into the armory cluster, per the
+[Delve audit-search integration plan](../../../doc/handoffs/delve-audit-integration-plan.md).
+**Phase 1** stood Delve up on Postgres at `https://delve.armory.local` with
+local Django auth; **Phase 3** (this role's `pki.yml` + `oidc_client.yml`) adds
+Keycloak human SSO and internal-TLS ingress re-encrypt. Machine ingestion lands
+in Phase 2.
 
 ## What it does
 
@@ -13,10 +15,23 @@ local Django superuser. Keycloak SSO and machine ingestion land in later phases.
    `delve` namespace as `delve-db-secret`, then provisions a single-replica
    Postgres StatefulSet (role-owned, **not** in the chart) and waits for it to
    be Ready.
-2. `deploy.yml` — provisions the external ingress TLS certificate, maps the
-   ingress host locally, renders the chart values, and releases the vendored
-   `charts/delve` Helm chart (`delve-web`, `delve-worker`, and a pre-install
-   `migrate` hook).
+2. `pki.yml` *(Phase 3, gated on `delve_oidc_enabled`)* — issues the internal
+   TLS cert (`delve-internal-tls`, from `openbao-pki-internal`) the web pod
+   serves HTTPS from for ingress re-encrypt.
+3. `oidc_client.yml` *(Phase 3, gated on `delve_oidc_enabled`)* — creates/updates
+   the confidential `delve` Keycloak client (redirect URI
+   `https://delve.armory.local/oidc/callback/`), ensures a `groups`
+   group-membership mapper, persists the credentials to `secret/delve/oidc`, and
+   VSO-syncs them into the `delve` namespace as `delve-oidc` **before** the Helm
+   release. Logins are the shared `armory` realm users; the Delve-side
+   `DelveOIDCBackend` maps `armory-admins`→superuser, `armory-operators`→staff,
+   `armory-viewers`→read.
+4. `deploy.yml` — provisions the external ingress TLS certificate, maps the
+   ingress host locally, resolves the issuer host to the ingress IP (pod
+   `hostAlias`), renders the chart values (flipping `oidc.enabled`/`tls.enabled`
+   and the `backend-protocol: HTTPS` annotation when SSO is on), and releases the
+   vendored `charts/delve` Helm chart (`delve-web`, `delve-worker`, and a
+   pre-install `migrate` hook).
 
 ## Cross-role wiring (not in this role)
 
@@ -25,12 +40,12 @@ These live elsewhere because role defaults are invisible across roles
 
 - **`inventories/development/group_vars/all.yml`** — `delve_namespace`,
   `delve_vso_sa_name`, `delve_openbao_policy_name`, `delve_openbao_k8s_role`,
-  `delve_openbao_db_path`, `delve_enabled`, and `delve` in
-  `trust_manager_internal_ca_target_namespaces`.
+  `delve_openbao_db_path`, `delve_openbao_oidc_path`, `delve_enabled`, and
+  `delve` in `trust_manager_internal_ca_target_namespaces`.
 - **`roles/openbao`** — `delve` is in `openbao_provisioner_kv_prefixes`
   (defaults), and `consumer_wiring.yml` writes the `delve-vso` ACL policy and
   Kubernetes auth role that let VSO in the `delve` namespace read
-  `secret/delve/db`.
+  `secret/delve/db` and `secret/delve/oidc`.
 
 ## Deviation from the plan
 

ansible/roles/delve/defaults/main.yml

@@ -80,6 +80,52 @@ delve_vault_auth_name: delve-vaultauth
 # SA and delve-vso).
 delve_pod_sa_name: delve
 
+# --- Phase 3: human SSO (Keycloak OIDC) + internal TLS re-encrypt ------------
+# Mirrors the headlamp role's oidc_client.yml / pki.yml. The KV path for the
+# OIDC credential (delve_openbao_oidc_path) and the VSO policy/role live in
+# group_vars/all.yml so the openbao role can grant read on them.
+
+# Keycloak admin API coordinates (used to create/update the delve client).
+delve_keycloak_enabled: true
+delve_keycloak_realm: armory
+delve_keycloak_namespace: keycloak
+delve_keycloak_service_name: keycloak-service
+delve_keycloak_service_https_port: 8443
+delve_keycloak_internal_fqdn: "{{ delve_keycloak_service_name }}.{{ delve_keycloak_namespace }}.svc.cluster.local"
+delve_keycloak_internal_api_url: "https://{{ delve_keycloak_internal_fqdn }}:{{ delve_keycloak_service_https_port }}"
+delve_keycloak_admin_secret_name: keycloak-bootstrap-admin
+delve_keycloak_admin_password_key: password
+delve_keycloak_admin_username_from_secret: true
+delve_keycloak_admin_username: admin
+
+# OIDC relying-party (confidential, standard flow) for browser SSO.
+delve_oidc_client_id: delve
+# If empty, a strong secret is generated once and persisted to OpenBao.
+delve_oidc_client_secret: ""
+delve_oidc_issuer_url: "{{ (keycloak_public_base_url | default(lookup('ansible.builtin.env', 'ARMORY_PUBLIC_BASE_URL') | default('https://armory.local', true))) + '/realms/' + delve_keycloak_realm }}"
+delve_oidc_scopes: "openid profile email"
+delve_oidc_ca_pem_url: "{{ delve_openbao_api_addr }}/v1/{{ openbao_pki_external_mount | default('pki-ext') }}/ca/pem"
+delve_oidc_secret_name: delve-oidc
+# mozilla-django-oidc callback registered with Keycloak.
+delve_oidc_redirect_path: /oidc/callback/
+
+# Pod-level OIDC issuer hostname resolution (hostAlias). The web pod must reach
+# the public issuer host in-cluster; resolve it to the ingress controller IP.
+delve_oidc_resolver_host: "{{ delve_oidc_issuer_url | urlsplit('hostname') }}"
+delve_oidc_resolver_service_namespace: ingress-nginx
+delve_oidc_resolver_service_name: ingress-nginx-controller
+
+# Internal TLS (cert-manager + OpenBao internal ClusterIssuer) for ingress
+# re-encrypt. The web pod serves HTTPS (cherrypy DELVE_SSL_*) from this cert and
+# the ingress backend-protocol becomes HTTPS.
+delve_oidc_enabled: "{{ delve_keycloak_enabled | bool }}"
+delve_internal_tls_secret_name: delve-internal-tls
+delve_internal_tls_issuer_name: openbao-pki-internal
+delve_internal_fqdn: "{{ delve_release_name }}-web.{{ delve_namespace }}.svc.cluster.local"
+delve_internal_tls_mount_path: /etc/delve-tls
+delve_oidc_ca_mount_path: /etc/delve-oidc
+delve_oidc_ca_file_name: oidc-ca.pem
+
 # Optional chart value overrides merged on top of role-managed values.
 delve_chart_values_overrides: {}
 

ansible/roles/delve/tasks/deploy.yml

@@ -55,6 +55,45 @@
     mode: "0644"
   become: true
 
+- name: Resolve in-cluster ingress IP for Delve OIDC issuer hostname
+  ansible.builtin.command:
+    cmd: >-
+      k3s kubectl get svc {{ delve_oidc_resolver_service_name }}
+      --namespace {{ delve_oidc_resolver_service_namespace }}
+      -o jsonpath={.spec.clusterIP}
+  environment:
+    KUBECONFIG: "{{ delve_kubeconfig_path }}"
+  register: _delve_oidc_resolver_ip_result
+  changed_when: false
+  failed_when: false
+  when:
+    - not ansible_check_mode
+    - delve_oidc_enabled | bool
+
+- name: Build Delve OIDC issuer hostAliases
+  ansible.builtin.set_fact:
+    _delve_oidc_host_aliases: >-
+      {{
+        [{'ip': (_delve_oidc_resolver_ip_result.stdout | default('') | trim),
+          'hostnames': [delve_oidc_resolver_host]}]
+        if ((delve_oidc_enabled | bool)
+            and (_delve_oidc_resolver_ip_result.stdout | default('') | trim | length) > 0)
+        else []
+      }}
+  changed_when: false
+
+- name: Build Delve ingress annotations
+  ansible.builtin.set_fact:
+    _delve_ingress_annotations: >-
+      {{
+        {'nginx.ingress.kubernetes.io/ssl-redirect': 'true'}
+        | combine(
+            {'nginx.ingress.kubernetes.io/backend-protocol': 'HTTPS'}
+            if (delve_oidc_enabled | bool) else {}
+          )
+      }}
+  changed_when: false
+
 - name: Build Delve chart values payload
   ansible.builtin.set_fact:
     _delve_chart_values: >-
@@ -82,7 +121,17 @@
             'port': 8000
           },
           'oidc': {
-            'enabled': False
+            'enabled': (delve_oidc_enabled | bool),
+            'secretName': delve_oidc_secret_name,
+            'scopes': delve_oidc_scopes,
+            'caMountPath': delve_oidc_ca_mount_path,
+            'caFileName': delve_oidc_ca_file_name,
+            'issuerHostAliases': (_delve_oidc_host_aliases | default([]))
+          },
+          'tls': {
+            'enabled': (delve_oidc_enabled | bool),
+            'secretName': delve_internal_tls_secret_name,
+            'mountPath': delve_internal_tls_mount_path
           },
           'ingress': {
             'enabled': True,
@@ -91,9 +140,7 @@
             'path': delve_ingress_path,
             'pathType': delve_ingress_path_type,
             'tlsSecretName': delve_tls_secret_name,
-            'annotations': {
-              'nginx.ingress.kubernetes.io/ssl-redirect': 'true'
-            }
+            'annotations': _delve_ingress_annotations
           }
         } | combine(delve_chart_values_overrides | default({}), recursive=True)
       }}

ansible/roles/delve/tasks/main.yml

@@ -11,6 +11,16 @@
       ansible.builtin.import_tasks: db.yml
       tags: [delve, delve_db, openbao, vso]
 
+    - name: Provision Delve internal TLS certificate (re-encrypt)
+      ansible.builtin.import_tasks: pki.yml
+      tags: [delve, delve_pki, cert_manager]
+      when: delve_oidc_enabled | bool
+
+    - name: Configure Delve Keycloak OIDC client and sync credentials
+      ansible.builtin.import_tasks: oidc_client.yml
+      tags: [delve, delve_oidc, keycloak, openbao, vso]
+      when: delve_oidc_enabled | bool
+
     - name: Deploy Delve via Helm
       ansible.builtin.import_tasks: deploy.yml
       tags: [delve, delve_deploy, openbao, vso]