Feat/keycloak official image - #1671
Draft
omrishiv wants to merge 2 commits into
Draft
Conversation
Retire the deprecated Bitnami keycloak subchart (and its bundled Bitnami
postgres) for a hand-rolled charts/keycloak subchart on the official
quay.io/keycloak/keycloak (26.6, CIMD-capable) and official postgres images.
charts/keycloak (new):
- Keycloak as a Deployment (stateless; state in postgres) + an official
postgres StatefulSet, preserving the load-bearing contract other components
depend on: the <release>-keycloak-headless:8080 service (internal
KEYCLOAK_URL) and <release>-keycloak:80.
- Upgrade-safe from a Bitnami-backed release: Keycloak switches STS->Deployment
(clean delete/create, no immutable-field conflict); postgres uses a new STS
name + fresh PVC; same-name/same-type services update in place.
- One-time data migration (default on, auto-detecting): a pre-upgrade Job
pg_dumps the legacy Bitnami DB and the new postgres restores it on first
init, normalized to a plain keycloak/keycloak DB (no bitnami/bn names). No
legacy source -> no-op; a genuine dump failure aborts the upgrade (fail-safe),
so a forgotten flag can't drop a database.
- Realm SSL-disable init preserved via a postStart hook using kcadm (the
official image has no curl). KC_FEATURES configurable ("cimd" enables CIMD).
Stack wiring:
- Chart.yaml: keycloak dependency bitnamicharts -> file://../keycloak.
- values.yaml: new keycloak block (official image, features "cimd",
postgres.migrateFromBitnami default true).
CIMD (Client ID Metadata Documents):
- keycloak-configure Job and keycloak/setup/init-keycloak.sh: new
configure_cimd_client_policy provisions a Keycloak client policy (a
client-id-uri condition + a client-id-metadata-document executor with a
trusted-domains allowlist) so MCP clients whose client_id is an https URL
(VS Code, Claude Code) authenticate by publishing their own metadata
document -- no pre-registration. Gated by ENABLE_CIMD_CONFIG / cimd.enabled;
trusted domains configurable (must cover each client's client_id host,
loopback redirect hosts, and CDN/logo hosts).
Verified: helm template + lint clean; embedded script.sh and init-keycloak.sh
pass bash -n; full helm unittest suite (41) green. Proven end-to-end on a live
Keycloak: bitnami->official upgrade preserved all realm data, and a
VS Code-style CIMD client_id drove Keycloak fetch/validate -> token ->
authorized MCP initialize.
…tack Signed-off-by: omrishiv <327609+omrishiv@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
Description of changes:
For #993 to work with Keycloak, we need a newer Keycloak image and to enable CIMD as a feature in keycloak. This PR switches from the Bitnami chart to the official Keycloak image and Postgres image while adding the changes needed to enable CIMD.
NOTE!!!
Deploying this chart will removed the old Postgres and Keycloak deployments; this is not a true upgrade. There is a best-effort attempt at dumping and restoring the postgres database, but it is recommended that you also dump the database. The contents of the database should only be manual changes made to keycloak unless the database was being used for something outside this project. The contents should be DCR client registrations, which are recreated transparently, and any manual changes to the realm/users. If you manually added users or made other changes, you may want to save them; otherwise, the initial bootstrap will recreate resources as normal.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.