Skip to content

Commit 0be4005

Browse files
urbanisierungurbanisierung
authored
feat(console-sm): integrate with identity (#931)
1 parent fcf6756 commit 0be4005

File tree

10 files changed

+74
-1
lines changed

10 files changed

+74
-1
lines changed

‎.vscode/settings.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
{
22
"markdown.extension.toc.levels": "2..3",
3-
}
3+
"editor.formatOnSaveMode": "modifications"
4+
}

‎charts/camunda-platform/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -527,6 +527,8 @@ Please see the corresponding [release guide](../../RELEASE.md) to find out how t
527527
| `global.identity.auth.optimize.redirectUrl` | defines the root (or redirect) URL, which is used by Keycloak to access Optimize. | `http://localhost:8083` |
528528
| `global.identity.auth.webModeler` | configuration to configure Web Modeler authentication specifics on global level, which can be accessed by other sub-charts | |
529529
| `global.identity.auth.webModeler.redirectUrl` | defines the root URL which is used by Keycloak to access Web Modeler. | `http://localhost:8084` |
530+
| `global.identity.auth.console` | configuration to configure Console authentication specifics on global level, which can be accessed by other sub-charts | |
531+
| `global.identity.auth.console.redirectUrl` | defines the root URL which is used by Keycloak to access Web Modeler. | `http://localhost:8080` |
530532
| `global.identity.auth.zeebe` | configuration to configure Zeebe authentication specifics on global level, which can be accessed by other sub-charts | |
531533
| `global.identity.auth.zeebe.existingSecret` | can be used to use an own existing secret. If not set a random secret is generated. | `""` |
532534

‎charts/camunda-platform/charts/identity/templates/_helpers.tpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,14 @@ Defines match labels for identity, which are extended by sub-charts and should b
6161
{{- printf "%s-operate-identity-secret" $name | trunc 63 | trimSuffix "-" | quote -}}
6262
{{- end }}
6363
64+
{{/*
65+
[identity] Create the name of the console-identity secret
66+
*/}}
67+
{{- define "identity.secretNameConsoleIdentity" -}}
68+
{{- $name := .Release.Name -}}
69+
{{- printf "%s-console-identity-secret" $name | trunc 63 | trimSuffix "-" | quote -}}
70+
{{- end }}
71+
6472
{{/*
6573
[identity] Create the name of the tasklist-identity secret
6674
*/}}

‎charts/camunda-platform/charts/identity/templates/console-secret.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if and (.Values.global.identity.auth.enabled) (or (not .Values.global.identity.auth.console.existingSecret) (typeIs "string" .Values.global.identity.auth.console.existingSecret)) }}
2+
{{- $secretName := include "identity.secretNameConsoleIdentity" . }}
3+
apiVersion: v1
4+
kind: Secret
5+
metadata:
6+
name: {{ $secretName }}
7+
labels: {{- include "identity.labels" . | nindent 4 }}
8+
type: Opaque
9+
data:
10+
console-secret: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "console-secret" "length" 10 "providedValues" (list "global.identity.auth.console.existingSecret") "context" $) }}
11+
{{- end }}

‎charts/camunda-platform/charts/identity/templates/deployment.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,25 @@ spec:
6161
{{- end }}
6262
- name: KEYCLOAK_INIT_OPERATE_ROOT_URL
6363
value: {{ tpl .Values.global.identity.auth.operate.redirectUrl $ | quote }}
64+
- name: KEYCLOAK_INIT_CONSOLE_SECRET
65+
{{- if and .Values.global.identity.auth.console.existingSecret (not (typeIs "string" .Values.global.identity.auth.console.existingSecret)) }}
66+
valueFrom:
67+
secretKeyRef:
68+
{{- /*
69+
Helper: https://github.com/bitnami/charts/blob/master/bitnami/common/templates/_secrets.tpl
70+
Usage in keycloak secrets https://github.com/bitnami/charts/blob/master/bitnami/keycloak/templates/secrets.yaml
71+
and in statefulset https://github.com/bitnami/charts/blob/master/bitnami/keycloak/templates/statefulset.yaml
72+
*/}}
73+
name: {{ include "common.secrets.name" (dict "existingSecret" .Values.global.identity.auth.console.existingSecret "context" $) }}
74+
key: console-secret
75+
{{- else }}
76+
valueFrom:
77+
secretKeyRef:
78+
name: {{ include "identity.secretNameConsoleIdentity" . }}
79+
key: console-secret
80+
{{- end }}
81+
- name: KEYCLOAK_INIT_CONSOLE_ROOT_URL
82+
value: {{ tpl .Values.global.identity.auth.console.redirectUrl $ | quote }}
6483
- name: KEYCLOAK_INIT_TASKLIST_SECRET
6584
{{- if and .Values.global.identity.auth.tasklist.existingSecret (not (typeIs "string" .Values.global.identity.auth.tasklist.existingSecret)) }}
6685
valueFrom:

‎charts/camunda-platform/templates/console/deployment.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,16 @@ spec:
3535
env:
3636
- name: NODE_ENV
3737
value: production
38+
- name: IDENTITY_BASE
39+
value: {{ tpl .Values.global.identity.auth.publicIssuerUrl $ | quote }}
40+
- name: IDENTITY_ISSUER_URL
41+
value: {{ tpl .Values.global.identity.auth.publicIssuerUrl $ | quote }}
42+
- name: IDENTITY_REALM
43+
value: camunda-platform
44+
- name: IDENTITY_AUDIENCE
45+
value: console
46+
- name: IDENTITY_CLIENT_ID
47+
value: console
3848
{{- if .Values.console.env}}
3949
{{ .Values.console.env | toYaml | nindent 12 }}
4050
{{- end }}

‎charts/camunda-platform/test/integration/scenarios/chart-full-setup/values-integration-test-ingress.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ global:
1515
identity:
1616
auth:
1717
publicIssuerUrl: "https://{{ .Values.global.ingress.host }}/auth/realms/camunda-platform"
18+
console:
19+
redirectUrl: "https://{{ .Values.global.ingress.host }}"
1820
operate:
1921
redirectUrl: "https://{{ .Values.global.ingress.host }}/operate"
2022
tasklist:

‎charts/camunda-platform/test/integration/scenarios/lib/chart-upgrade-taskfile.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ tasks:
2626
-n $TEST_NAMESPACE -o jsonpath="{.data.operate-secret}" | base64 --decode)
2727
export CONNECTORS_SECRET=$(kubectl get secret "integration-connectors-identity-secret" \
2828
-n $TEST_NAMESPACE -o jsonpath="{.data.connectors-secret}" | base64 --decode)
29+
export CONSOLE_SECRET=$(kubectl get secret "integration-console-identity-secret" \
30+
-n $TEST_NAMESPACE -o jsonpath="{.data.console-secret}" | base64 --decode)
2931
export KEYCLOAK_ADMIN_SECRET=$(kubectl get secret "integration-keycloak" \
3032
-n $TEST_NAMESPACE -o jsonpath="{.data.admin-password}" | base64 --decode)
3133
export KEYCLOAK_POSTGRESQL_SECRET=$(kubectl get secret "integration-postgresql" \
@@ -42,6 +44,7 @@ tasks:
4244
--set global.identity.auth.optimize.existingSecret=$OPTIMIZE_SECRET \
4345
--set global.identity.auth.operate.existingSecret=$OPERATE_SECRET \
4446
--set global.identity.auth.connectors.existingSecret=$CONNECTORS_SECRET \
47+
--set --set global.identity.auth.console.existingSecret=$CONSOLE_SECRET \
4548
--set identity.keycloak.auth.adminPassword=$KEYCLOAK_ADMIN_SECRET \
4649
--set identity.keycloak.postgresql.auth.password=$KEYCLOAK_POSTGRESQL_SECRET \
4750
--set global.postgresql.auth.password=${IDENTITY_POSTGRESQL_SECRET} \

‎charts/camunda-platform/test/unit/identity/golden/deployment.golden.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,13 @@ spec:
5959
key: operate-secret
6060
- name: KEYCLOAK_INIT_OPERATE_ROOT_URL
6161
value: "http://localhost:8081"
62+
- name: KEYCLOAK_INIT_CONSOLE_SECRET
63+
valueFrom:
64+
secretKeyRef:
65+
name: "camunda-platform-test-console-identity-secret"
66+
key: console-secret
67+
- name: KEYCLOAK_INIT_CONSOLE_ROOT_URL
68+
value: "http://localhost:8080"
6269
- name: KEYCLOAK_INIT_TASKLIST_SECRET
6370
valueFrom:
6471
secretKeyRef:

‎charts/camunda-platform/values.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,16 @@ global:
185185
# Can be overwritten if ingress is in use and an external IP is available.
186186
redirectUrl: "http://localhost:8084"
187187

188+
## @extra global.identity.auth.console configuration to configure Console authentication specifics on global level, which can be accessed by other sub-charts
189+
console:
190+
## @param global.identity.auth.console.existingSecret can be used to use an own existing secret. If not set a random secret is generated.
191+
# The existing secret should contain an `console-secret` field, which will be used as secret for the identity-console communication.
192+
existingSecret:
193+
## @param global.identity.auth.console.redirectUrl defines the root URL which is used by Keycloak to access Web Modeler.
194+
# Should be publicly accessible, the default value works if a port-forward to Web Modeler is created to 8080.
195+
# Can be overwritten if ingress is in use and an external IP is available.
196+
redirectUrl: "http://localhost:8080"
197+
188198
## @extra global.identity.auth.zeebe configuration to configure Zeebe authentication specifics on global level, which can be accessed by other sub-charts
189199
zeebe:
190200
## @param global.identity.auth.zeebe.existingSecret can be used to use an own existing secret. If not set a random secret is generated.

0 commit comments

Comments
 (0)