feat(keycloak): expose via ingress with KC_HOSTNAME for browser OIDC redirect

Author: Viczei

.kontinuous/env/dev/templates/keycloak.deployment.yaml

@@ -27,13 +27,22 @@ spec:
       containers:
         - name: keycloak
           image: quay.io/keycloak/keycloak:26.0
-          args:
-            - start-dev
-            - --import-realm
+          command:
+            - /bin/bash
+            - -c
+            - |
+              export KC_HOSTNAME=https://keycloak-${POD_NAMESPACE}.ovh.fabrique.social.gouv.fr
+              exec /opt/keycloak/bin/kc.sh start-dev --import-realm
           ports:
             - containerPort: 8080
               name: http
           env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: KC_PROXY_HEADERS
+              value: xforwarded
             - name: KEYCLOAK_ADMIN
               value: admin
             - name: KEYCLOAK_ADMIN_PASSWORD

.kontinuous/env/dev/values.yaml

@@ -28,6 +28,12 @@ app:
     MAILER_SMTP_HOST: maildev
     MAILER_SMTP_PORT: "1025"
     MAILER_SMTP_SSL: "False"
+    EGAPRO_PROCONNECT_DISCOVERY_URL: "https://keycloak-{{ .Values.global.namespace }}.ovh.fabrique.social.gouv.fr/realms/egapro"
+    EGAPRO_PROCONNECT_MANAGE_ORGANISATIONS_URL: "https://keycloak-{{ .Values.global.namespace }}.ovh.fabrique.social.gouv.fr/realms/egapro/account"
+    EGAPRO_PROCONNECT_PERSONAL_INFORMATION_URL: "https://keycloak-{{ .Values.global.namespace }}.ovh.fabrique.social.gouv.fr/realms/egapro/account"
+
+keycloak:
+  enabled: true
 
 maildev: {}
 pgweb: {}

.kontinuous/templates/keycloak.ingress.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.keycloak }}
+{{- if .Values.keycloak.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  tls:
+    - hosts:
+        - keycloak-{{ .Values.global.namespace }}.ovh.fabrique.social.gouv.fr
+      secretName: api-crt
+  rules:
+    - host: keycloak-{{ .Values.global.namespace }}.ovh.fabrique.social.gouv.fr
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  number: 8080
+{{- end }}
+{{- end }}