Auth via Keycloak

Tiltfile

@@ -18,6 +18,10 @@
 load('ext://helm_resource', 'helm_resource', 'helm_repo')
 load("ext://restart_process", "docker_build_with_restart")
 load("ext://secret", "secret_create_generic")
+load('ext://dotenv', 'dotenv')
+
+# Load .env file if it exists
+dotenv()
 
 config.define_string("aws_role", usage='AWS role to use for deployment')
 cfg = config.parse();
@@ -33,6 +37,13 @@ if aws_role:
 lifecycle_app = 'lifecycle-app'
 app_namespace = 'lifecycle-app'
 
+# NGROK Configuration
+ngrok_authtoken = os.getenv("NGROK_AUTHTOKEN", "")
+ngrok_domain = os.getenv("NGROK_LIFECYCLE_DOMAIN", "")
+ngrok_keycloak_domain = os.getenv("NGROK_KEYCLOAK_DOMAIN", "")
+ngrok_ui_domain = os.getenv("NGROK_LIFECYCLE_UI_DOMAIN", "")
+
+
 ##################################
 # Create Namespace
 ##################################
@@ -118,16 +129,27 @@ docker_build_with_restart(
     ],
 )
 
+helm_set_args = [
+    'namespace={}'.format(app_namespace),
+    'image.repository={}'.format(lifecycle_app),
+    'image.tag=dev',
+    'keycloak.url={}'.format(ngrok_keycloak_domain or 'localhost'),
+    'keycloak.appUrl={}'.format(ngrok_domain or 'localhost:5001'),
+    'keycloak.uiUrl={}'.format(ngrok_ui_domain or 'localhost:3000'),
+    # Update IDP URLs to use ngrok domain or localhost
+    'keycloak.companyIdp.tokenUrl=https://{}/realms/company/protocol/openid-connect/token'.format(ngrok_keycloak_domain) if ngrok_keycloak_domain else 'keycloak.companyIdp.tokenUrl=http://localhost:8080/realms/company/protocol/openid-connect/token',
+    'keycloak.companyIdp.authorizationUrl=https://{}/realms/company/protocol/openid-connect/auth'.format(ngrok_keycloak_domain) if ngrok_keycloak_domain else 'keycloak.companyIdp.authorizationUrl=http://localhost:8080/realms/company/protocol/openid-connect/auth',
+    'keycloak.companyIdp.userInfoUrl=https://{}/realms/company/protocol/openid-connect/userinfo'.format(ngrok_keycloak_domain) if ngrok_keycloak_domain else 'keycloak.companyIdp.userInfoUrl=http://localhost:8080/realms/company/protocol/openid-connect/userinfo',
+    'keycloak.companyIdp.jwksUrl=https://{}/realms/company/protocol/openid-connect/certs'.format(ngrok_keycloak_domain) if ngrok_keycloak_domain else 'keycloak.companyIdp.jwksUrl=http://localhost:8080/realms/company/protocol/openid-connect/certs',
+    'keycloak.companyIdp.issuer=https://{}/realms/company'.format(ngrok_keycloak_domain) if ngrok_keycloak_domain else 'keycloak.companyIdp.issuer=http://localhost:8080/realms/company',
+]
+
 lifecycle_deployment = decode_yaml_stream(helm(
     './helm/web-app/',
     name='lifecycle',
     namespace=app_namespace,
     values=['./helm/environments/local/lifecycle.yaml', './helm/environments/local/secrets.yaml'],
-    set=[
-        'namespace={}'.format(app_namespace),
-        'image.repository={}'.format(lifecycle_app),
-        'image.tag=dev',
-    ]
+    set=helm_set_args
 ))
 
 patched_deploy = []
@@ -160,23 +182,26 @@ for r in patched_deploy:
         name = r["metadata"]["name"]
         labels = []
         port_forwards = []
+        resource_deps = []
+
+        # Don't add postgres/redis deps for keycloak resources
+        if "keycloak" not in name:
+            resource_deps = ['local-postgres', 'redis']
         if "web" in name:
             labels = ["web"]
             port_forwards = ['5001:80']
         elif "worker" in name:
             labels = ["worker"]
         k8s_resource(
             name,
-            resource_deps=['local-postgres', 'redis'],
+            resource_deps=resource_deps,
             labels=labels,
             port_forwards=port_forwards
         )
 
 ##################################
 # NGROK
 ##################################
-ngrok_authtoken = os.getenv("NGROK_AUTHTOKEN", "")
-ngrok_domain = os.getenv("NGROK_LIFECYCLE_DOMAIN", "")
 
 ngrok_secret_yaml = """
 apiVersion: v1
@@ -188,17 +213,44 @@ type: Opaque
 stringData:
   NGROK_AUTHTOKEN: "{}"
   NGROK_LIFECYCLE_DOMAIN: "{}"
-""".format(app_namespace, ngrok_authtoken, ngrok_domain)
+  NGROK_KEYCLOAK_DOMAIN: "{}"
+""".format(app_namespace, ngrok_authtoken, ngrok_domain, ngrok_keycloak_domain)
 
 ngrok_secret_obj = decode_yaml_stream(ngrok_secret_yaml)
 k8s_yaml(encode_yaml_stream(ngrok_secret_obj))
+
+# Main app ngrok
 k8s_yaml('sysops/tilt/ngrok.yaml')
 k8s_resource(
     'ngrok',
     port_forwards=['4040:4040'],
     labels=["infra"]
 )
 
+# Ngrok for Keycloak
+k8s_yaml('sysops/tilt/ngrok-keycloak.yaml')
+k8s_resource(
+    'ngrok-keycloak',
+    port_forwards=['4041:4040'],  # Different local port for Keycloak ngrok admin
+    labels=["infra"]
+)
+
+##################################
+# Keycloak (deployed via Helm)
+##################################
+# Keycloak is deployed as part of the lifecycle helm release
+# We just need to configure the resources for Tilt UI
+k8s_resource(
+    'lifecycle-keycloak',
+    port_forwards=['8081:8080'],
+    labels=["infra"],
+    resource_deps=['lifecycle-keycloak-postgresql']
+)
+k8s_resource(
+    'lifecycle-keycloak-postgresql',
+    labels=["infra"]
+)
+
 ##################################
 # DISTRIBUTION
 ##################################

helm/environments/local/lifecycle.yaml

@@ -150,3 +150,68 @@ redis:
 
 rbac:
   create: true
+
+keycloak:
+  enabled: true
+  realm: lifecycle
+  url: localhost
+  appUrl: localhost:5001
+
+  adminUsername: admin
+  adminPassword: admin
+  defaultUserPassword: changeme
+
+  postgresUsername: keycloakdb
+  postgresPassword: keycloakdb
+
+  lifecycleCoreClientSecret: changeme
+
+  # Identity Provider configurations (disabled for local dev, enable as needed)
+  companyIdp:
+    enabled: true
+    clientId: app-broker
+    clientSecret: changeme
+    tokenUrl: http://localhost:8080/realms/company/protocol/openid-connect/token
+    authorizationUrl: http://localhost:8080/realms/company/protocol/openid-connect/auth
+    userInfoUrl: http://localhost:8080/realms/company/protocol/openid-connect/userinfo
+    jwksUrl: http://localhost:8080/realms/company/protocol/openid-connect/certs
+    issuer: http://localhost:8080/realms/company
+
+  githubIdp:
+    enabled: true
+    # clientId and clientSecret will be taken from secrets.githubClientId and secrets.githubClientSecret
+    # clientId
+    # clientSecret
+
+  image:
+    registry: quay.io
+    repository: keycloak/keycloak
+    tag: 26.3.4
+
+  resources:
+    requests:
+      cpu: 400m
+      memory: 512Mi
+    limits:
+      memory: 768Mi
+
+  postgresImage:
+    registry: ''
+    repository: library/postgres
+    tag: 16.3-alpine
+
+  postgresResources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+
+  persistent: true
+  volumeSize: 1Gi
+
+  ingress:
+    enabled: false
+    className: nginx
+    tls: false