feat(keycloak): add Keycloak Helm chart using upstream image#40
Merged
mikkeldamsgaard merged 12 commits intomainfrom Mar 14, 2026
Merged
feat(keycloak): add Keycloak Helm chart using upstream image#40mikkeldamsgaard merged 12 commits intomainfrom
mikkeldamsgaard merged 12 commits intomainfrom
Conversation
Add a production-grade Keycloak chart that deploys the upstream quay.io/keycloak/keycloak image with native KC_* environment variable configuration. Supports PostgreSQL, MySQL, MSSQL, and dev (H2) databases, jdbc-ping and kubernetes (dns-ping) clustering, optional build optimization init container, TLS passthrough, Prometheus ServiceMonitor, and all standard Kubernetes deployment knobs. Closes #39 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add comprehensive E2E test infrastructure for the Keycloak chart: - ci/scripts/e2e-keycloak.sh with dev, postgres, and replicas scenarios - E2E value files for each scenario (dev H2, PostgreSQL, multi-replica) - Tests verify health, metrics, OIDC discovery, admin token acquisition, realm/client/user creation via REST API, and multi-replica clustering - Makefile targets: e2e-keycloak-dev, e2e-keycloak-postgres, e2e-keycloak-replicas, e2e-keycloak (all three) Improve NOTES.txt with detailed admin credential setup instructions, REST API quick start guide, and production database guidance. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use dorny/paths-filter to detect which charts changed and only run the relevant E2E test jobs. NetBird E2E tests only run when charts/netbird/** or its CI scripts change; Keycloak E2E tests only run when charts/keycloak/** or its CI scripts change. Changes to CI config files (workflow, Makefile, dprint, helmfmt) trigger all E2E tests. Format-check and lint+unittest always run. Adds three new Keycloak E2E jobs: dev, postgres, and replicas. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move E2E and utility scripts into per-chart directories: - ci/scripts/netbird/ — e2e.sh, e2e-oidc.sh, compat-matrix.sh - ci/scripts/keycloak/ — e2e.sh - ci/scripts/upstream-check.sh stays at root (repo-level) Update all references in CI workflow, Makefile, and script headers. Update paths-filter to use glob patterns for the new directory structure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move docs/compatibility.md to charts/netbird/docs/compatibility.md so it lives alongside the chart it documents. Add .helmignore to exclude docs/, tests/, ci/, and README.md from the packaged chart. Update compat-matrix.sh and release skill references. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The keycloak.fullname helper returns "keycloak-e2e" (not "keycloak-e2e-keycloak") because the chart name is contained in the release name. Fix all references in the E2E script and CI workflow debug steps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Exclude docs/, tests/, ci/, and README.md from the packaged chart, matching the netbird chart convention. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add keycloak/keycloak to .upstream-monitor.yaml with both version and appVersion as targets (they are kept in sync). Update release skill to document that the keycloak chart version is synced with the upstream Keycloak appVersion. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dev mode (H2 embedded DB) was forcing KC_CACHE=ispn with jdbc-ping, which requires a shared database for cluster discovery. Use local cache instead, matching Keycloak's default for start-dev. Also fix deployment template rendering empty volumeMounts: and volumes: fields when no volumes are configured, and improve e2e script to capture debug info (pod status, logs, events) before cleanup on failure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rtup Keycloak 26.5 requires either KC_HOSTNAME to be set or KC_HOSTNAME_STRICT=false. The chart defaulted hostnameStrict to true without a hostname, causing Keycloak to crash on startup with: "hostname is not configured; either configure hostname, or set hostname-strict to false" Change the default to false so Keycloak starts without requiring a hostname. Users setting a hostname should also set hostnameStrict: true. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
mikkeldamsgaard
force-pushed
the
feat/39-keycloak-chart
branch
from
ee43f9c to
ad42737
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
quay.io/keycloak/keycloakimage with nativeKC_*environment variable configurationjdbc-ping(default) andkubernetes(dns-ping) clustering with auto-configured JGroups DNS query via headless servicekc.sh build), TLS passthrough, Prometheus ServiceMonitor, extraEnvVars/Volumes, and persistent storage for themes/providersCloses #39
Test plan
helm lintpasseshelm templaterenders correctly for default (dev), PostgreSQL, and full-feature configurations🤖 Generated with Claude Code