operator bootstrap admin handling #30711

shawkins · 2024-06-24T18:35:40Z

This is layered on the other bootstrap changes. After looking at the implementation possiblities a little more, I think it makes more sense to manage things at a secret level - giving us 2 secrets to worry about instead of 4 - and just assume the keys by convention.

To minimize the number of api server interactions per reconciliation we also won't attempt to write back values into user provided secrets - if the user specifies the secret, then we expect it to exist and the fields be present. We can of course add optional handling if that seems warrented.

@vmuzikar WDYT?

vmuzikar

@shawkins Thank you for the Operator changes. Overall looks good, added just some minor comments. We'll also need some tests.

...or/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/BootstrapAdminSpec.java

vmuzikar · 2024-06-25T15:54:33Z

To minimize the number of api server interactions per reconciliation we also won't attempt to write back values into user provided secrets - if the user specifies the secret, then we expect it to exist and the fields be present.

This works for me. We just populate the default Secret.

We probably should also add some docs and reflect it there.

closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]>

shawkins · 2024-07-05T17:45:49Z

We probably should also add some docs and reflect it there.

Added some docs to the advanced guide, see if that works for you.

vmuzikar

@shawkins Added some last suggestions, nothing really blocking.

docs/guides/operator/advanced-configuration.adoc

vmuzikar · 2024-07-05T18:40:48Z

docs/guides/operator/advanced-configuration.adoc

+When you create a new instance the Keycloak CR spec.bootstrapAdmin stanza may be used to configure the bootstrap user and/or service account. If you do not specify anything for the spec.bootstrapAdmin, the operator will create a Secret named "metadata.name"-initial-admin with a username temp-admin and a generated password. If you specify a Secret name for bootstrap admin user, then the Secret will need to contain username and password key value pairs. If you specify a Secret name for bootstrap admin service account, then the Secret will need to contain client-id and client-secret key value pairs.
+
+If a master realm has already been created for you cluster, then the spec.boostrapAdmin is effectively ignored. If you need to create a recovery admin account, then you'll need to run the CLI command against a Pod directly.
+


It might be also good to add a link here to the Admin Bootstrapping guide (once it's merged).

Ok, we can wait for #31039 to be merged first

...or/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/spec/BootstrapAdminSpec.java

Co-authored-by: Václav Muzikář <[email protected]> Signed-off-by: Steven Hawkins <[email protected]>

closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]>

shawkins · 2024-07-09T18:59:08Z

The strategy of modifying the Keycloak spec in the controller does not work well here - the dependents run before the controller, so we end up with a race condition as to whether a deployment is attempted without a bootstrap admin secret. Rather than trying to customize the operator workflow, the simplest thing is just to treat a non-specified user secret as the default.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2024-07-09T19:27:52Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.url.HostnameV2Test#testAdminLocal

Keycloak CI - Base IT (6)

java.net.UnknownHostException: 127.0.0.1.nip.io: Temporary failure in name resolution
	at java.base/java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)
	at java.base/java.net.Inet6AddressImpl.lookupAllHostAddr(Inet6AddressImpl.java:52)
	at java.base/java.net.InetAddress$PlatformResolver.lookupByName(InetAddress.java:1211)
	at java.base/java.net.InetAddress.getAddressesFromNameService(InetAddress.java:1828)
...

Report flaky test

vmuzikar

The changes still look good to me. I'd like to merge this rather sooner than later. We can add the docs link as a follow up. @shawkins WDYT?

vmuzikar · 2024-07-24T14:52:23Z

operator/src/main/java/org/keycloak/operator/controllers/KeycloakController.java


        Log.debugf("--- Reconciling Keycloak: %s in namespace: %s", kcName, namespace);

+        // TODO - these modifications to the resource belong in a webhook because dependents run first


Isn't this essentially an Operator SDK bug? We're not doing anything special here...

@vmuzikar I don't think it's a bug, just how the operator sdk works by default.

Then how are we supposed to update spec?

We can update it here, but not in a way that will cause a race condition. The pr initially didn't assume a default in the deployment dependent logic which lead to the initial creation of the statefulset without bootstrap env variables.

It's not a hard reqirement for this feature that the spec is populated with the defaults.

Ok, I see. Thanks for clarifying!

shawkins · 2024-07-24T15:16:41Z

The changes still look good to me. I'd like to merge this rather sooner than later. We can add the docs link as a follow up. @shawkins WDYT?

Sounds good.

* enhance: add bootstrap admin handling to the operator closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]> * Update docs/guides/operator/advanced-configuration.adoc Co-authored-by: Václav Muzikář <[email protected]> Signed-off-by: Steven Hawkins <[email protected]> * enhance: add bootstrap admin handling to the operator closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]> --------- Signed-off-by: Steve Hawkins <[email protected]> Signed-off-by: Steven Hawkins <[email protected]> Co-authored-by: Václav Muzikář <[email protected]>

This reverts commit 3139b82.

shawkins requested review from a team as code owners June 24, 2024 18:35

keycloak-github-bot bot added team/cloud-native labels Jun 24, 2024

shawkins changed the title ~~draft of Iss30004~~ draft of operator bootstrap admin handling Jun 24, 2024

keycloak-github-bot bot added the flaky-test label Jun 24, 2024

This was referenced Jun 24, 2024

Flaky test: org.keycloak.testsuite.organization.exportimport.OrganizationExportTest#testExport #30598

Closed

Flaky test: org.keycloak.testsuite.oauth.TokenIntrospectionTest#testUnsupportedToken #30111

Closed

vmuzikar requested review from Pepo48, mabartos and vmuzikar June 25, 2024 08:51

vmuzikar reviewed Jun 25, 2024

View reviewed changes

vmuzikar linked an issue Jul 4, 2024 that may be closed by this pull request

Bootstrapping an admin user or service account using the Operator #30004

Closed

enhance: add bootstrap admin handling to the operator

f0f74db

closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]>

shawkins force-pushed the iss30004 branch from a98a26b to f0f74db Compare July 5, 2024 17:44

shawkins changed the title ~~draft of operator bootstrap admin handling~~ operator bootstrap admin handling Jul 5, 2024

vmuzikar reviewed Jul 5, 2024

View reviewed changes

Update docs/guides/operator/advanced-configuration.adoc

15afa61

Co-authored-by: Václav Muzikář <[email protected]> Signed-off-by: Steven Hawkins <[email protected]>

shawkins force-pushed the iss30004 branch from c487b67 to 15afa61 Compare July 8, 2024 14:09

enhance: add bootstrap admin handling to the operator

009721e

closes: keycloak#30004 Signed-off-by: Steve Hawkins <[email protected]>

shawkins force-pushed the iss30004 branch from 3dc69e1 to 009721e Compare July 9, 2024 18:56

keycloak-github-bot bot reviewed Jul 9, 2024

View reviewed changes

vmuzikar approved these changes Jul 24, 2024

View reviewed changes

vmuzikar merged commit 3139b82 into keycloak:main Jul 24, 2024

vmuzikar mentioned this pull request Jul 24, 2024

Document admin bootstrapping and recovery #31039

Merged

stianst mentioned this pull request Jul 25, 2024

testsuite poc managed realm wrapper #31618

Closed

vmuzikar added a commit to vmuzikar/keycloak that referenced this pull request Jul 26, 2024

Revert "operator bootstrap admin handling (keycloak#30711)"

2efc15e

This reverts commit 3139b82.

ahus1 pushed a commit that referenced this pull request Jul 26, 2024

Revert "operator bootstrap admin handling (#30711)"

6f62e67

This reverts commit 3139b82.

		When you create a new instance the Keycloak CR spec.bootstrapAdmin stanza may be used to configure the bootstrap user and/or service account. If you do not specify anything for the spec.bootstrapAdmin, the operator will create a Secret named "metadata.name"-initial-admin with a username temp-admin and a generated password. If you specify a Secret name for bootstrap admin user, then the Secret will need to contain username and password key value pairs. If you specify a Secret name for bootstrap admin service account, then the Secret will need to contain client-id and client-secret key value pairs.

		If a master realm has already been created for you cluster, then the spec.boostrapAdmin is effectively ignored. If you need to create a recovery admin account, then you'll need to run the CLI command against a Pod directly.


		Log.debugf("--- Reconciling Keycloak: %s in namespace: %s", kcName, namespace);

		// TODO - these modifications to the resource belong in a webhook because dependents run first

operator bootstrap admin handling #30711

operator bootstrap admin handling #30711

Uh oh!

Conversation

shawkins commented Jun 24, 2024

Uh oh!

vmuzikar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vmuzikar commented Jun 25, 2024

Uh oh!

shawkins commented Jul 5, 2024

Uh oh!

vmuzikar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vmuzikar Jul 5, 2024

Choose a reason for hiding this comment

Uh oh!

shawkins Jul 8, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

shawkins commented Jul 9, 2024

Uh oh!

keycloak-github-bot bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot bot commented Jul 9, 2024

Unreported flaky test detected

org.keycloak.testsuite.url.HostnameV2Test#testAdminLocal

Uh oh!

vmuzikar left a comment

Choose a reason for hiding this comment

Uh oh!

vmuzikar Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

shawkins Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vmuzikar Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

shawkins Jul 24, 2024

Choose a reason for hiding this comment

Uh oh!

vmuzikar Jul 25, 2024

Choose a reason for hiding this comment

Uh oh!

shawkins commented Jul 24, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants