From 36b264f21287547fc8c8ffd6a55864cd958eb58d Mon Sep 17 00:00:00 2001 From: Codex Agent Date: Thu, 4 Jun 2026 11:01:54 +0800 Subject: [PATCH] fix(keycloak): use supported admin bootstrap env --- .../k8s/keycloak/keycloak-bootstrap-job.yaml | 99 ++++++++----------- deploy/k8s/keycloak/keycloak.yaml | 4 +- 2 files changed, 41 insertions(+), 62 deletions(-) diff --git a/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml b/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml index 3134ea12..e64ac4d7 100644 --- a/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml +++ b/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml @@ -37,87 +37,66 @@ spec: set -eu KC=http://keycloak.keycloak.svc.cluster.local:8080 for i in $(seq 1 60); do - if curl -sf $KC/realms/master > /dev/null; then + code=$(curl -s -o /dev/null -w '%{http_code}' $KC/realms/master || true) + code=${code:-000} + if [ "$code" = "200" ]; then echo keycloak-ready exit 0 fi - echo waiting-for-keycloak + echo "waiting-for-keycloak status=$code" sleep 5 done echo keycloak-not-ready exit 1 - - name: get-admin-token + containers: + - name: bootstrap image: curlimages/curl:8.10.1 env: - - name: ADMIN_PASSWORD_FILE - value: /tmp/admin-password + - name: PASSWORD + valueFrom: + secretKeyRef: + name: keycloak-admin + key: password + - name: CLIENT_SECRET + valueFrom: + secretKeyRef: + name: hwlab-cloud-web-client + key: client-secret command: - /bin/sh - -c - | set -eu - ADMIN_PASSWORD=$(cat $ADMIN_PASSWORD_FILE/password) - curl -sf -X POST http://keycloak.keycloak.svc.cluster.local:8080/realms/master/protocol/openid-connect/token \ + KC=http://keycloak.keycloak.svc.cluster.local:8080 + REALM=hwlab + echo fetching-admin-token + curl -sf -X POST $KC/realms/master/protocol/openid-connect/token \ -H 'content-type: application/x-www-form-urlencoded' \ --data-urlencode 'username=admin' \ - --data-urlencode "password=$ADMIN_PASSWORD" \ + --data-urlencode "password=$PASSWORD" \ --data-urlencode 'grant_type=password' \ --data-urlencode 'client_id=admin-cli' > /tmp/token.json - if grep -q access_token /tmp/token.json; then - echo token-ok - else - echo token-failed + TOKEN=$(grep -oE '"access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f4) + if [ -z "$TOKEN" ]; then + echo no-token cat /tmp/token.json exit 1 fi - volumeMounts: - - name: admin-password - mountPath: /tmp/admin-password - readOnly: true - - name: create-realm - image: curlimages/curl:8.10.1 - env: - - name: CLIENT_SECRET_FILE - value: /tmp/client-secret - command: - - /bin/sh - - -c - - | - set -eu - TOKEN=$(grep -oE 'access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f3) - if [ -z "$TOKEN" ]; then - echo no-token - exit 1 - fi - KC=http://keycloak.keycloak.svc.cluster.local:8080 - REALM=hwlab - if curl -sf -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM > /dev/null; then + echo token-ok + code=$(curl -s -o /tmp/realm.json -w '%{http_code}' -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM) + if [ "$code" = "200" ]; then echo realm-already-exists - exit 0 + else + echo creating-realm + curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}' + echo realm-created + fi + client_code=$(curl -s -o /tmp/clients.json -w '%{http_code}' -H "Authorization: Bearer $TOKEN" "$KC/admin/realms/$REALM/clients?clientId=hwlab-cloud-web") + if [ "$client_code" = "200" ] && grep -q '"clientId":"hwlab-cloud-web"' /tmp/clients.json; then + echo client-already-exists + else + echo creating-client + curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d "{\"clientId\":\"hwlab-cloud-web\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}" + echo client-created fi - echo creating-realm - curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}' - echo realm-created - CLIENT_SECRET=$(cat $CLIENT_SECRET_FILE/client-secret) - curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' -d "{\"clientId\":\"hwlab-cloud-web\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}" - echo client-created - volumeMounts: - - name: client-secret - mountPath: /tmp/client-secret - readOnly: true - containers: - - name: done - image: curlimages/curl:8.10.1 - command: - - /bin/sh - - -c - - | echo keycloak-bootstrap-complete - sleep 30 - volumes: - - name: admin-password - secret: - secretName: keycloak-admin - - name: client-secret - secret: - secretName: hwlab-cloud-web-client diff --git a/deploy/k8s/keycloak/keycloak.yaml b/deploy/k8s/keycloak/keycloak.yaml index 45562c3e..7b9a94ad 100644 --- a/deploy/k8s/keycloak/keycloak.yaml +++ b/deploy/k8s/keycloak/keycloak.yaml @@ -61,9 +61,9 @@ items: - name: management containerPort: 9000 env: - - name: KC_BOOTSTRAP_ADMIN_USERNAME + - name: KEYCLOAK_ADMIN value: admin - - name: KC_BOOTSTRAP_ADMIN_PASSWORD + - name: KEYCLOAK_ADMIN_PASSWORD valueFrom: secretKeyRef: name: keycloak-admin