Skip to content

chore(helm-chart): add secure keycloak admin console option #4219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wesjdj wants to merge 2 commits into
base: master
Choose a base branch
from
Open

chore(helm-chart): add secure keycloak admin console option #4219

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f8e1b7
chore(helm-chart): add secure keycloak admin console option
wesjdj Oct 23, 2025
7b3b0fb
docs: clarify accessing keycloak if admin console access is secured
wesjdj Oct 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion docs/docs/20-admins/30-operation/80-user-management.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,11 @@ Renku uses [Keycloak](https://www.keycloak.org/) as its identity provider. When

### Accessing Keycloak Admin Console

1. Navigate to your Keycloak instance (at `https://<your-domain>/auth`)
:::warning
By default, the Keycloak Admin Console is publicly accessible. We recommend restricting access. Setting `global.keycloak.secureAdminConsole=true` in your Renku Helm values limits access to port-forwarding only (port `8080` on the Keycloak pod), blocking public URL access.
:::

1. Navigate to your Keycloak instance (at `https://<your-domain>/auth`, or `http://localhost:8080` if `global.keycloak.secureAdminConsole=true` is set and you have port-forwarded)
2. Click on "Administration Console"
3. Log in with your admin credentials
4. Select the Renku realm to manage users and roles
Expand Down
19 changes: 19 additions & 0 deletions helm-chart/renku/templates/keycloak-admin-console.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
{{- if .Values.keycloakx.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: keycloak-admin-console
labels:
app: {{ template "renku.name" . }}
chart: {{ template "renku.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
annotations:
helm.sh/hook: pre-install,pre-upgrade,pre-rollback
helm.sh/hook-delete-policy: before-hook-creation
data:
{{- if .Values.global.keycloak.secureAdminConsole }}
KC_HOSTNAME_ADMIN_URL: http://localhost:8080
{{- end }}
{{- end }}
4 changes: 4 additions & 0 deletions helm-chart/renku/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ global:
url:
## Explicitly set another realm than "renku" here
realm:
## Secure the Keycloak admin console by limiting access to localhost. We recommend enabling this. The admin console can still be accessed by port-forwarding the pod on port 8080.
secureAdminConsole: false
gateway:
## Client secret of the renku client application registered in keycloak.
## Should be set to a proper value (i.e. by using openssl rand -hex 32) for production.
Expand Down Expand Up @@ -305,6 +307,8 @@ keycloakx:
name: renku-keycloak-postgres
- secretRef:
name: keycloak-password-secret
- configMapRef:
name: keycloak-admin-console
Comment on lines +310 to +311

@leafty leafty Oct 23, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason not to use extraEnv directly? If the value changes and helm upgrade is executed, then the extraEnvFrom will not update which means the new value will not cause a pod template re-render.

@wesjdj wesjdj Oct 23, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed whether we wanted to make the change as an extraEnv in our deployment values, but it would mean having to copy all the extraEnvs currently in the Renku chart values.yaml into our deployment values. The other option was to modify the Renku chart. The consensus was to make the change in the chart, but the value change not triggering a restart of the pod is not ideal.

@aledegano a compromise could be keeping the new configMapRef in the values.yaml, but keeping it commented out, and using that as the secureAdminConsole toggle instead?

@leafty leafty Oct 23, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand: if you add the definition to extraEnv just above, you can use helm chart rendering with the value, so I don't see why it's not just added there.

@wesjdj wesjdj Oct 24, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The issue is that extraEnv in the Renku chart's values.yaml is defined as a multi-line string, not as a YAML list. This means we can't simply append to it from our deployment values.

When you override a string value in Helm, it completely replaces the original. So if we add our new environment variable to extraEnv in our deployment values, we would lose all the existing environment variables defined in the chart's values.yaml.

To use extraEnv from our deployment values, we'd have to copy all existing environment variables from the chart plus add our new one. That's fragile because if the chart updates those values in the future, our deployment values won't pick up those changes.

That's why modifying the chart directly (using extraEnvFrom with a ConfigMap) seemed like cleaner options, though I agree the pod restart issue with extraEnvFrom is not ideal.

@leafty leafty Oct 27, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To make sure things are clear: what I am suggesting is simply to set:

  extraEnv: |
    - name: KC_DB
      value: postgres
    - name: KC_DB_PORT
      value: "5432"
    - name:  PROXY_ADDRESS_FORWARDING
      value: "true"
    - name: JAVA_OPTS_APPEND
      value: >-
        -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless
    - name: KC_DB_POOL_MAX_SIZE
      value: "10"
    {{- if .Values.global.keycloak.secureAdminConsole }}
    - name: KC_HOSTNAME_ADMIN_URL
      value: http://localhost:8080
    {{- end -}}

in the values here. This requires no further change for deployment.

extraVolumeMounts: |
- name: theme
mountPath: /opt/keycloak/themes/renku-theme
Expand Down