From 8b1dd1527a8e950872e4b4d35cda4758464eac02 Mon Sep 17 00:00:00 2001 From: Oleksandr Andriienko Date: Fri, 10 Sep 2021 12:36:00 +0300 Subject: [PATCH] feat: Update keycloak from 6.0.1 to 15 (#1015) * Use keycloak 15. Add separated option to debug keycloak server. Signed-off-by: Oleksandr Andriienko --- .github/bin/common.sh | 11 -- api/v1/checluster_types.go | 3 + .../che-operator.clusterserviceversion.yaml | 4 +- .../manifests/org_v1_che_crd.yaml | 3 + .../che-operator.clusterserviceversion.yaml | 4 +- .../manifests/org_v1_che_crd.yaml | 3 + config/crd/bases/org_v1_che_crd-v1beta1.yaml | 3 + config/crd/bases/org_v1_che_crd.yaml | 3 + .../org.eclipse.che_v1_checluster.yaml | 1 - .../devworkspace/solver/che_routing_test.go | 1 - .../identity-provider/deployment_keycloak.go | 101 +++++++++--------- pkg/deploy/ingress.go | 4 + 12 files changed, 76 insertions(+), 65 deletions(-) diff --git a/.github/bin/common.sh b/.github/bin/common.sh index 09e2766ee..8bfa0b3f4 100755 --- a/.github/bin/common.sh +++ b/.github/bin/common.sh @@ -449,22 +449,11 @@ login() { # Deploy Eclipse Che behind proxy in openshift ci deployCheBehindProxy() { - # Get the ocp domain for che custom resources - export DOMAIN=$(oc get dns cluster -o json | jq .spec.baseDomain | sed -e 's/^"//' -e 's/"$//') - - # Related issue:https://github.com/eclipse/che/issues/17681 - cat >/tmp/che-cr-patch.yaml < 0 { keycloakEnv = append(keycloakEnv, corev1.EnvVar{ - Name: "POSTGRES_PASSWORD", + Name: "DB_PASSWORD", ValueFrom: &corev1.EnvVarSource{ SecretKeyRef: &corev1.SecretKeySelector{ Key: "password", @@ -310,7 +313,7 @@ func GetSpecKeycloakDeployment( }) } else { keycloakEnv = append(keycloakEnv, corev1.EnvVar{ - Name: "POSTGRES_PASSWORD", + Name: "DB_PASSWORD", Value: deployContext.CheCluster.Spec.Auth.IdentityProviderPostgresPassword, }) } @@ -516,33 +519,12 @@ func GetSpecKeycloakDeployment( keycloakEnv = append(keycloakEnv, envvar) } - var enableFixedHostNameProvider string - if deployContext.CheCluster.IsInternalClusterSVCNamesEnabled() { - if cheFlavor == "che" { - keycloakURL, err := url.Parse(deployContext.CheCluster.Status.KeycloakURL) - if err != nil { - return nil, err - } - hostname := keycloakURL.Hostname() - enableFixedHostNameProvider = " && echo 'Use fixed hostname provider to make working internal network requests' && " + - "echo -e \"embed-server --server-config=standalone.xml --std-out=echo \n" + - "/subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value=\"fixed\") \n" + - "/subsystem=keycloak-server/spi=hostname/provider=fixed:write-attribute(name=properties.hostname,value=\"" + hostname + "\") \n" - if deployContext.CheCluster.Spec.Server.TlsSupport { - enableFixedHostNameProvider += "/subsystem=keycloak-server/spi=hostname/provider=fixed:write-attribute(name=properties.httpsPort,value=\"443\") \n" + - "/subsystem=keycloak-server/spi=hostname/provider=fixed:write-attribute(name=properties.alwaysHttps,value=\"true\") \n" - } else { - enableFixedHostNameProvider += "/subsystem=keycloak-server/spi=hostname/provider=fixed:write-attribute(name=properties.httpPort,value=\"80\") \n" - } - enableFixedHostNameProvider += "stop-embedded-server\" > " + jbossDir + "/use_fixed_hostname_provider.cli && " + - jbossCli + " --file=" + jbossDir + "/use_fixed_hostname_provider.cli " - } - if cheFlavor == "codeready" { - keycloakEnv = append(keycloakEnv, corev1.EnvVar{ - Name: "KEYCLOAK_FRONTEND_URL", - Value: deployContext.CheCluster.Status.KeycloakURL, - }) - } + // Enable internal network for keycloak + if deployContext.CheCluster.IsInternalClusterSVCNamesEnabled() && !deployContext.CheCluster.Spec.Auth.ExternalIdentityProvider { + keycloakEnv = append(keycloakEnv, corev1.EnvVar{ + Name: "KEYCLOAK_FRONTEND_URL", + Value: deployContext.CheCluster.Status.KeycloakURL, + }) } evaluateKeycloakSystemProperties := "KEYCLOAK_SYS_PROPS=\"-Dkeycloak.profile.feature.token_exchange=enabled -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled\"" @@ -562,8 +544,8 @@ func GetSpecKeycloakDeployment( " && " + evaluateKeycloakSystemProperties + " && " + evaluateExpectContinueEnabled + " && " + evaluateReuseConnections + - " && " + changeConfigCommand + enableFixedHostNameProvider + - " && /opt/jboss/docker-entrypoint.sh -b 0.0.0.0 -c standalone.xml $KEYCLOAK_SYS_PROPS" + " && " + changeConfigCommand + + " && /opt/jboss/tools/docker-entrypoint.sh -b 0.0.0.0 -c standalone.xml $KEYCLOAK_SYS_PROPS" if cheFlavor == "codeready" { addUsernameReadonlyTheme := "baseTemplate=/opt/eap/themes/base/login/login-update-profile.ftl" + @@ -600,6 +582,35 @@ func GetSpecKeycloakDeployment( command = "echo \"ssl_required WAS UPDATED for master realm.\" && " + command } + ports := []corev1.ContainerPort{ + { + Name: deploy.IdentityProviderName, + ContainerPort: 8080, + Protocol: "TCP", + }, + } + + if deployContext.CheCluster.Spec.Auth.Debug { + ports = append(ports, corev1.ContainerPort{ + Name: "debug", + ContainerPort: 8787, + Protocol: "TCP", + }) + + keycloakEnv = append(keycloakEnv, []corev1.EnvVar{ + { + Name: "DEBUG", + Value: "true", + }, + { + Name: "DEBUG_PORT", + Value: "*:8787", + }, + }...) + + command += " --debug" + } + args := []string{"-c", command} deployment := &appsv1.Deployment{ @@ -638,14 +649,8 @@ func GetSpecKeycloakDeployment( Command: []string{ "/bin/sh", }, - Args: args, - Ports: []corev1.ContainerPort{ - { - Name: deploy.IdentityProviderName, - ContainerPort: 8080, - Protocol: "TCP", - }, - }, + Args: args, + Ports: ports, Resources: corev1.ResourceRequirements{ Requests: corev1.ResourceList{ corev1.ResourceMemory: util.GetResourceQuantity( diff --git a/pkg/deploy/ingress.go b/pkg/deploy/ingress.go index fe4d84b84..9f2d97237 100644 --- a/pkg/deploy/ingress.go +++ b/pkg/deploy/ingress.go @@ -104,6 +104,10 @@ func GetIngressSpec( if ingressStrategy != "multi-host" && (component == DevfileRegistryName || component == PluginRegistryName) { annotations["nginx.ingress.kubernetes.io/rewrite-target"] = "/$1" } + // Set bigger proxy buffer size to prevent 502 auth error. + if component == IdentityProviderName { + annotations["nginx.ingress.kubernetes.io/proxy-buffer-size"] = "16k" + } for k, v := range ingressCustomSettings.Annotations { annotations[k] = v }