Keycloak packaged by Bitnami¶

Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.

Overview of Keycloak

Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.

TL;DR¶

使用加速地址添加仓库:

helm repo add bitnami "https://helm-charts.itboon.top/bitnami" --force-update
helm update bitnami

helm install my-release bitnami/keycloak

Introduction¶

Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads.

This chart bootstraps a Keycloak deployment on a Kubernetes cluster using the Helm package manager.

Bitnami charts can be used with Kubeapps for deployment and management of Helm Charts in clusters.

Looking to use Keycloak in production? Try VMware Application Catalog, the enterprise edition of Bitnami Application Catalog.

Prerequisites¶

• Kubernetes 1.19+
• Helm 3.2.0+

Installing the Chart¶

To install the chart with the release name my-release:

helm install my-release bitnami/keycloak

These commands deploy a Keycloak application on the Kubernetes cluster in the default configuration.

Tip: List all releases using helm list

Uninstalling the Chart¶

To uninstall/delete the my-release deployment:

helm delete my-release

The command removes all the Kubernetes components associated with the chart and deletes the release.

Parameters¶

Global parameters¶

Common parameters¶

Keycloak parameters¶

Keycloak statefulset parameters¶

Exposure parameters¶

RBAC parameter¶

Other parameters¶

Metrics parameters¶

keycloak-config-cli parameters¶

Database parameters¶

Keycloak Cache parameters¶

Keycloak Logging parameters¶

Specify each parameter using the --set key=value[,key=value] argument to helm install. For example,

helm install my-release --set auth.adminPassword=secretpassword bitnami/keycloak

The above command sets the Keycloak administrator password to secretpassword.

NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available.

Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,

helm install my-release -f values.yaml bitnami/keycloak

Tip: You can use the default values.yaml

Keycloak realms, users and clients can be created from the Keycloak administration panel. Refer to the tutorial on adding user authentication to applications with Keycloak for more details on these operations.

Configuration and installation details¶

Rolling vs Immutable tags¶

It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.

Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.

Use an external database¶

Sometimes, you may want to have Keycloak connect to an external PostgreSQL database rather than a database within your cluster - for example, when using a managed database service, or when running a single database server for all your applications. To do this, set the postgresql.enabled parameter to false and specify the credentials for the external database using the externalDatabase.* parameters.

Refer to the chart documentation on using an external database for more details and an example.

NOTE: Only PostgreSQL database server is supported as external database

It is not supported but possible to run Keycloak with an external MSSQL database with the following settings:

externalDatabase:
  host: "mssql.example.com"
  port: 1433
  user: keycloak
  database: keycloak
  existingSecret: passwords
extraEnvVars:
  - name: KC_DB # override values from the conf file
    value: 'mssql'
  - name: KC_DB_URL
    value: 'jdbc:sqlserver://mssql.example.com:1433;databaseName=keycloak;'

Add extra environment variables¶

In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the extraEnvVars property.

extraEnvVars:
  - name: KEYCLOAK_LOG_LEVEL
    value: DEBUG

Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the extraEnvVarsCM or the extraEnvVarsSecret values.

Use Sidecars and Init Containers¶

If additional containers are needed in the same pod (such as additional metrics or logging exporters), they can be defined using the sidecars config parameter. Similarly, extra init containers can be added using the initContainers parameter.

Refer to the chart documentation for more information on, and examples of, configuring and using sidecars and init containers.

Initialize a fresh instance¶

The Bitnami Keycloak image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, you can specify custom scripts using the initdbScripts parameter as dict.

In addition to this option, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the initdbScriptsConfigMap parameter. Note that this will override the previous option.

The allowed extensions is .sh.

Deploy extra resources¶

There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the extraDeploy parameter.

Set Pod affinity¶

This chart allows you to set your custom affinity using the affinity parameter. Find more information about Pod's affinity in the kubernetes documentation.

As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the bitnami/common chart. To do so, set the podAffinityPreset, podAntiAffinityPreset, or nodeAffinityPreset parameters.

Configure Ingress¶

This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as nginx-ingress-controller or contour you can utilize the ingress controller to serve your application.

To enable Ingress integration, set ingress.enabled to true. The ingress.hostname property can be used to set the host name. The ingress.tls parameter can be used to add the TLS configuration for this host. It is also possible to have more than one host, with a separate TLS configuration for each host. Learn more about configuring and using Ingress.

Configure TLS Secrets for use with Ingress¶

The chart also facilitates the creation of TLS secrets for use with the Ingress controller, with different options for certificate management. Learn more about TLS secrets.

Use with ingress offloading SSL¶

If your ingress controller has the SSL Termination, you should set proxy to edge.

Manage secrets and passwords¶

This chart provides several ways to manage passwords:

• Values passed to the chart
• An existing secret with all the passwords (via the existingSecret parameter)
• Multiple existing secrets with all the passwords (via the existingSecretPerPassword parameter)

Refer to the chart documentation on managing passwords for examples of each method.

Troubleshooting¶

Find more information about how to deal with common errors related to Bitnami's Helm charts in this troubleshooting guide.

Upgrading¶

To 15.0.0¶

This major updates the default serviceType from LoadBalancer to ClusterIP to avoid inadvertently exposing Keycloak directly to the internet without an Ingress.

To 12.0.0¶

This major updates the PostgreSQL subchart to its newest major, 12.0.0. Here you can find more information about the changes introduced in that version.

To any previous version¶

Refer to the chart documentation for more information about how to upgrade from previous releases.

License¶

Copyright © 2023 VMware, Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.