Turn off Keycloak HTTP and make the Keycloak HTTPS only

This is the default for Keycloak. HTTP is insecure.
projectsyn · Dec 8, 2022 · 0c3b61e · 0c3b61e
1 parent b64d757
commit 0c3b61e
Show file tree

Hide file tree

Showing 5 changed files with 47 additions and 17 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -172,7 +172,6 @@ parameters:
       args:
         - start
         - --auto-build
-        - --http-enabled=true # Helm chart requires it currently
 
       # extraEnv *MUST* be a string, as it's fed through a templating
       # function.
@@ -252,6 +251,29 @@ parameters:
         annotations: ${keycloak:_service_annotations:${keycloak:tls:provider}}
         httpPort: 8080
         labels: ${keycloak:labels}
+      livenessProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/live'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 0
+        timeoutSeconds: 5
+      readinessProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/ready'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 10
+        timeoutSeconds: 1
+      startupProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 15
+        timeoutSeconds: 1
+        failureThreshold: 60
+        periodSeconds: 5
       serviceMonitor:
         enabled: ${keycloak:monitoring:enabled}
         labels: ${keycloak:labels}

diff --git a/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -57,7 +57,6 @@ spec:
         - args:
             - start
             - --auto-build
-            - --http-enabled=true
           env:
             - name: FOO
               value: bar
@@ -104,7 +103,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -118,7 +118,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -135,7 +136,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -57,7 +57,6 @@ spec:
         - args:
             - start
             - --auto-build
-            - --http-enabled=true
           env:
             - name: JAVA_OPTS
               value: -XX:+UseContainerSupport -XX:MaxRAMPercentage=50.0 -Djava.net.preferIPv4Stack=true
@@ -102,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -116,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -133,7 +134,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/...ft-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...ft-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -57,7 +57,6 @@ spec:
         - args:
             - start
             - --auto-build
-            - --http-enabled=true
           env:
             - name: JAVA_OPTS
               value: -XX:+UseContainerSupport -XX:MaxRAMPercentage=50.0 -Djava.net.preferIPv4Stack=true
@@ -102,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -116,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -133,7 +134,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/.../openshift/openshift/openshift/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/.../openshift/openshift/openshift/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -57,7 +57,6 @@ spec:
         - args:
             - start
             - --auto-build
-            - --http-enabled=true
           env:
             - name: JAVA_OPTS
               value: -XX:+UseContainerSupport -XX:MaxRAMPercentage=50.0 -Djava.net.preferIPv4Stack=true
@@ -102,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -116,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -131,7 +132,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1