Turn off Keycloak HTTP and make the Keycloak HTTPS only

This is the default for Keycloak. HTTP is insecure.
projectsyn · Sep 18, 2023 · a30f02e · a30f02e
1 parent c422e2f
commit a30f02e
Show file tree

Hide file tree

Showing 5 changed files with 47 additions and 12 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -272,6 +272,29 @@ parameters:
         annotations: ${keycloak:_service_annotations:${keycloak:tls:provider}}
         httpPort: 8080
         labels: ${keycloak:labels}
+      livenessProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/live'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 0
+        timeoutSeconds: 5
+      readinessProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health/ready'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 10
+        timeoutSeconds: 1
+      startupProbe: |
+        httpGet:
+          path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/health'
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 15
+        timeoutSeconds: 1
+        failureThreshold: 60
+        periodSeconds: 5
       serviceMonitor:
         enabled: ${keycloak:monitoring:enabled}
         labels: ${keycloak:labels}

diff --git a/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -103,7 +103,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -117,7 +118,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -134,7 +136,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -101,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -115,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -132,7 +134,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/...ft-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...ft-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -101,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -115,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -132,7 +134,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/.../openshift/openshift/openshift/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/.../openshift/openshift/openshift/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -101,7 +101,8 @@ spec:
           livenessProbe:
             httpGet:
               path: /auth/health/live
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
@@ -115,7 +116,8 @@ spec:
           readinessProbe:
             httpGet:
               path: /auth/health/ready
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -130,7 +132,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /auth/health
-              port: http
+              port: https
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1