|
1 | 1 | # Keycloak-deployment |
2 | 2 |
|
3 | | - |
4 | 3 | This repository contains all our scripts to deploy keycloak on Openshift and minishift. |
5 | 4 | Also we have scripts to bake our own docker image using the keycloak source code |
6 | 5 | from our repository `almighty/keycloak`. |
| 6 | + |
| 7 | +# Almighty-Keycloak Docker Image |
| 8 | + |
| 9 | +To build this image it is necessary to have previously generated the executables of this |
| 10 | +project. To do this, run the following Maven command in the almighty/keycloak repository: |
| 11 | + |
| 12 | +`$ mvn clean install -DskipTests -pl :keycloak-server-dist -am -P distribution` |
| 13 | + |
| 14 | +This generates some tarballs with the required executables. To build the docker image, |
| 15 | +copy the generated tar file (e.g. `keycloak-3.0.0.Final.tar.gz`) from the almighty/keycloak |
| 16 | +repository into the docker folder, like so: |
| 17 | + |
| 18 | +`$ cp $KEYCLOAK_REPO/distribution/server-dist/target/keycloak-3.0.0.Final.tar.gz $KEYCLOAK_DEPLOYMENT_REPO/docker` |
| 19 | + |
| 20 | +Then you just need to build the docker image. Change into the docker directory and run the following command: |
| 21 | + |
| 22 | +`$ docker build --tag IMAGE_NAME .` |
| 23 | + |
| 24 | +If you would like to build image for clustered mode add build argument |
| 25 | + |
| 26 | +`$ docker build --build-arg OPERATING_MODE=clustered --tag IMAGE_NAME .` |
| 27 | + |
| 28 | +Note that, this docker image installs the certificate to securely talk to OpenShift Online. |
| 29 | +This step is done inside the `install_certificate.sh` script which adds this |
| 30 | +certificate into the Java system keystore at building time. We assume this certificate |
| 31 | +points to `tsrv.devshift.net`. So any change to the certificate requires rebuilding the |
| 32 | +Docker image. |
| 33 | + |
| 34 | +In the content of the Dockerfile, you can find these ENV variables: |
| 35 | +``` |
| 36 | +ENV OSO_ADDRESS tsrv.devshift.net:8443 |
| 37 | +ENV OSO_DOMAIN_NAME tsrv.devshift.net |
| 38 | +``` |
| 39 | + |
| 40 | +Also note that it is possible to use a certificate from minishift. To do this, first obtain the |
| 41 | +IP address of your minishift instance: |
| 42 | + |
| 43 | +``` |
| 44 | +minishift ip |
| 45 | +``` |
| 46 | + |
| 47 | +Then edit docker/Dockerfile and replace these values with the minishift IP (this is just an example, |
| 48 | +the address will most likely be different): |
| 49 | + |
| 50 | +``` |
| 51 | +ENV OSO_ADDRESS 192.168.42.134:8443 |
| 52 | +ENV OSO_DOMAIN_NAME 192.168.42.134 |
| 53 | +``` |
| 54 | + |
| 55 | +The command for building the docker image will need to be slightly different, since docker build by default does not |
| 56 | +have access to local IP addresses. Add the --network="host" parameter to allow the install_certificate.sh script to |
| 57 | +connect to minishift and retrieve the certificate: |
| 58 | + |
| 59 | +`$ docker build --network="host" --tag IMAGE_NAME .` |
| 60 | + |
| 61 | + |
| 62 | +# Openshift Configuration for clustered deployment |
| 63 | + |
| 64 | +Majority of the config is defined in `DeploymentConfig` files you can find in `openshift` folder in the root of this repository. |
| 65 | + |
| 66 | +There is one thing needed however to have properly functioning cluster (using [k8s PING protocol in `jgroups`](https://github.com/jgroups-extras/jgroups-kubernetes)). |
| 67 | +Service account has to have `view` privileges. This can be enabled using `oc` cli as follows: |
| 68 | + |
| 69 | +``` |
| 70 | +$ oc policy add-role-to-user view system:serviceaccount:$(oc project -q):default -n $(oc project -q) |
| 71 | +``` |
| 72 | + |
| 73 | +# Deploying Keycloak to Minishift |
| 74 | + |
| 75 | +To deploy a Keycloak cluster in minishift use the following commands: |
| 76 | + |
| 77 | +``` |
| 78 | +oc new-project keycloak --display-name="Keycloak server" \ |
| 79 | +--description="keycloak server + postgres" |
| 80 | +
|
| 81 | +oc new-app -f postgresql.json |
| 82 | +sleep 20 |
| 83 | +
|
| 84 | +# deploying 3 keycloak instances |
| 85 | +oc new-app -f keycloak.json |
| 86 | +``` |
| 87 | + |
| 88 | +### Customization options |
| 89 | + |
| 90 | +#### KeyCloak |
| 91 | + |
| 92 | +edit environment variables: |
| 93 | + |
| 94 | + "env":[ |
| 95 | + { |
| 96 | + "name":"KEYCLOAK_USER", |
| 97 | + "value":"admin" |
| 98 | + }, |
| 99 | + { |
| 100 | + "name":"KEYCLOAK_PASSWORD", |
| 101 | + "value":"admin" |
| 102 | + }, |
| 103 | + { |
| 104 | + "name":"POSTGRES_DATABASE", |
| 105 | + "value":"userdb" |
| 106 | + }, |
| 107 | + { |
| 108 | + "name":"POSTGRES_USER", |
| 109 | + "value":"keycloak" |
| 110 | + }, |
| 111 | + { |
| 112 | + "name":"POSTGRES_PASSWORD", |
| 113 | + "value":"password" |
| 114 | + }, |
| 115 | + { |
| 116 | + "name":"POSTGRES_PORT_5432_TCP_ADDR", |
| 117 | + "value":"postgres" |
| 118 | + }, |
| 119 | + { |
| 120 | + "name":"POSTGRES_PORT_5432_TCP_PORT", |
| 121 | + "value":"5432" |
| 122 | + }, |
| 123 | + { |
| 124 | + "name":"OPERATING_MODE", |
| 125 | + "value":"clustered" |
| 126 | + } |
| 127 | + ] |
| 128 | + |
| 129 | + |
| 130 | +#### Postgresql |
| 131 | + |
| 132 | + "env": [ |
| 133 | + { |
| 134 | + "name": "POSTGRESQL_USER", |
| 135 | + "value": "keycloak" |
| 136 | + }, |
| 137 | + { |
| 138 | + "name": "POSTGRESQL_PASSWORD", |
| 139 | + "value": "password" |
| 140 | + }, |
| 141 | + { |
| 142 | + "name": "POSTGRESQL_DATABASE", |
| 143 | + "value": "userdb" |
| 144 | + }, |
| 145 | + { |
| 146 | + "name": "POSTGRESQL_ADMIN_PASSWORD", |
| 147 | + "value": "password" |
| 148 | + } |
| 149 | + ] |
0 commit comments