mirror of
https://github.com/outbackdingo/homelab-v.git
synced 2026-08-25 14:53:19 +00:00
feat(crossplane): remove crossplane
Crossplane was only used to configure Keycloak, no need for it with Keycloak gone Signed-off-by: Vegard Hagen <[email protected]>
This commit is contained in:
Vegard Hagen
@@ -1,12 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ns.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: crossplane
|
||||
repo: https://charts.crossplane.io/stable
|
||||
releaseName: crossplane
|
||||
namespace: crossplane
|
||||
version: 1.19.1
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: crossplane
|
||||
@@ -1,34 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: crossplane-crds
|
||||
namespace: argocd
|
||||
labels:
|
||||
dev.stonegarden: crossplane-crds
|
||||
spec:
|
||||
generators:
|
||||
- git:
|
||||
repoURL: https://github.com/vehagn/homelab
|
||||
revision: HEAD
|
||||
directories:
|
||||
- path: k8s/infra/crossplane-crds/*
|
||||
template:
|
||||
metadata:
|
||||
name: 'crossplane-crds-{{ path.basename }}'
|
||||
labels:
|
||||
dev.stonegarden: crossplane-crds
|
||||
spec:
|
||||
project: crossplane-crds
|
||||
source:
|
||||
plugin:
|
||||
name: kustomize-build-with-helm
|
||||
repoURL: https://github.com/vehagn/homelab
|
||||
targetRevision: HEAD
|
||||
path: '{{ path }}'
|
||||
destination:
|
||||
name: in-cluster
|
||||
namespace: argocd
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
@@ -1,35 +0,0 @@
|
||||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: Composition
|
||||
metadata:
|
||||
name: keycloak-builtin-objects
|
||||
spec:
|
||||
compositeTypeRef:
|
||||
apiVersion: keycloak.crossplane.io/v1alpha1
|
||||
kind: XBuiltinObjects
|
||||
mode: Pipeline
|
||||
pipeline:
|
||||
- step: pull-provider-configs
|
||||
functionRef:
|
||||
name: function-extra-resources
|
||||
input:
|
||||
apiVersion: extra-resources.fn.crossplane.io/v1beta1
|
||||
kind: Input
|
||||
spec:
|
||||
extraResources:
|
||||
- kind: Secret
|
||||
into: secrets
|
||||
apiVersion: v1
|
||||
type: Selector
|
||||
selector:
|
||||
minMatch: 1
|
||||
maxMatch: 100
|
||||
matchLabels:
|
||||
- key: type
|
||||
type: Value
|
||||
value: provider-credentials
|
||||
- step: keycloak-builtin-objects
|
||||
functionRef:
|
||||
name: function-keycloak-builtin-objects
|
||||
- step: automatically-detect-ready-composed-resources
|
||||
functionRef:
|
||||
name: function-auto-ready
|
||||
@@ -1,189 +0,0 @@
|
||||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: Composition
|
||||
metadata:
|
||||
name: keycloak-oidc-client
|
||||
spec:
|
||||
compositeTypeRef:
|
||||
apiVersion: oidc.homelab.olav.ninja/v1alpha1
|
||||
kind: XOidcClient
|
||||
mode: Pipeline
|
||||
pipeline:
|
||||
- step: create-client
|
||||
functionRef:
|
||||
name: function-go-templating
|
||||
input:
|
||||
apiVersion: gotemplating.fn.crossplane.io/v1beta1
|
||||
kind: GoTemplate
|
||||
source: Inline
|
||||
inline:
|
||||
template: |
|
||||
apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
|
||||
kind: Client
|
||||
metadata:
|
||||
annotations:
|
||||
gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}
|
||||
spec:
|
||||
forProvider:
|
||||
name: {{ .observed.composite.resource.spec.displayName }}
|
||||
accessType: {{ .observed.composite.resource.spec.type }}
|
||||
clientId: {{ .observed.composite.resource.spec.clientId }}
|
||||
{{ with .observed.composite.resource.spec.clientSecretSecretRef }}
|
||||
clientSecretSecretRef: {{ toYaml . | nindent 6 }}
|
||||
{{ end }}
|
||||
description: {{ .observed.composite.resource.spec.description }}
|
||||
{{ with .observed.composite.resource.spec.baseUrl }}
|
||||
baseUrl: {{ . }}
|
||||
{{ end }}
|
||||
{{ with .observed.composite.resource.spec.redirectUris }}
|
||||
validRedirectUris: {{ toYaml . | nindent 6 }}
|
||||
{{ end }}
|
||||
{{ with .observed.composite.resource.spec.postLogoutRedirectUris }}
|
||||
validPostLogoutRedirectUris: {{ toYaml . | nindent 6 }}
|
||||
{{ end }}
|
||||
{{ with .observed.composite.resource.spec.webOrigins }}
|
||||
webOrigins: {{ toYaml . | nindent 6 }}
|
||||
{{ end }}
|
||||
{{ if has "client_credentials" .observed.composite.resource.spec.grantTypes }}
|
||||
serviceAccountsEnabled: true
|
||||
{{ end }}
|
||||
{{ if has "code" .observed.composite.resource.spec.grantTypes }}
|
||||
standardFlowEnabled: true
|
||||
{{ end }}
|
||||
{{ if has "device_code" .observed.composite.resource.spec.grantTypes }}
|
||||
oauth2DeviceAuthorizationGrantEnabled: true
|
||||
{{ end }}
|
||||
{{ if has "password" .observed.composite.resource.spec.grantTypes }}
|
||||
directAccessGrantsEnabled: true
|
||||
{{- end }}
|
||||
realmIdRef:
|
||||
name: {{ .observed.composite.resource.spec.realm }}
|
||||
- step: create-audience-mapper
|
||||
functionRef:
|
||||
name: function-go-templating
|
||||
input:
|
||||
apiVersion: gotemplating.fn.crossplane.io/v1beta1
|
||||
kind: GoTemplate
|
||||
source: Inline
|
||||
inline:
|
||||
template: |
|
||||
{{ if ne $.observed.resources nil }}
|
||||
apiVersion: client.keycloak.crossplane.io/v1alpha1
|
||||
kind: ProtocolMapper
|
||||
metadata:
|
||||
annotations:
|
||||
gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-audience-mapper
|
||||
spec:
|
||||
forProvider:
|
||||
name: Set token audience
|
||||
protocol: openid-connect
|
||||
protocolMapper: oidc-audience-mapper
|
||||
config:
|
||||
included.client.audience: "{{ .observed.composite.resource.spec.clientId }}"
|
||||
id.token.claim: "false"
|
||||
access.token.claim: "true"
|
||||
introspection.token.claim: "true"
|
||||
userinfo.token.claim: "false"
|
||||
clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
|
||||
realmIdRef:
|
||||
name: {{ .observed.composite.resource.spec.realm }}
|
||||
{{ end }}
|
||||
- step: create-usermodel-property-mapper
|
||||
functionRef:
|
||||
name: function-go-templating
|
||||
input:
|
||||
apiVersion: gotemplating.fn.crossplane.io/v1beta1
|
||||
kind: GoTemplate
|
||||
source: Inline
|
||||
inline:
|
||||
template: |
|
||||
{{ if ne $.observed.resources nil }}
|
||||
apiVersion: client.keycloak.crossplane.io/v1alpha1
|
||||
kind: ProtocolMapper
|
||||
metadata:
|
||||
annotations:
|
||||
gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-sub-mapper
|
||||
spec:
|
||||
forProvider:
|
||||
name: Username as sub claim
|
||||
protocol: openid-connect
|
||||
protocolMapper: oidc-usermodel-property-mapper
|
||||
config:
|
||||
user.attribute: username
|
||||
id.token.claim: "true"
|
||||
access.token.claim: "true"
|
||||
claim.name: sub
|
||||
userinfo.token.claim: "true"
|
||||
clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
|
||||
realmIdRef:
|
||||
name: {{ .observed.composite.resource.spec.realm }}
|
||||
{{ end }}
|
||||
- step: create-client-default-scopes
|
||||
functionRef:
|
||||
name: function-go-templating
|
||||
input:
|
||||
apiVersion: gotemplating.fn.crossplane.io/v1beta1
|
||||
kind: GoTemplate
|
||||
source: Inline
|
||||
inline:
|
||||
template: |
|
||||
{{ if ne $.observed.resources nil }}
|
||||
{{ if .observed.composite.resource.spec.defaultScopes }}
|
||||
apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
|
||||
kind: ClientDefaultScopes
|
||||
metadata:
|
||||
annotations:
|
||||
gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-default-scopes
|
||||
spec:
|
||||
forProvider:
|
||||
{{ with .observed.composite.resource.spec.defaultScopes }}
|
||||
defaultScopes: {{ toYaml . | nindent 6 }}
|
||||
{{ end }}
|
||||
clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
|
||||
realmIdRef:
|
||||
name: {{ .observed.composite.resource.spec.realm }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
- step: create-service-account-role
|
||||
functionRef:
|
||||
name: function-go-templating
|
||||
input:
|
||||
apiVersion: gotemplating.fn.crossplane.io/v1beta1
|
||||
kind: GoTemplate
|
||||
source: Inline
|
||||
inline:
|
||||
template: |
|
||||
{{ range .observed.composite.resource.spec.serviceAccountRoles }}
|
||||
---
|
||||
apiVersion: meta.gotemplating.fn.crossplane.io/v1alpha1
|
||||
kind: ExtraResources
|
||||
requirements:
|
||||
client:
|
||||
apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
|
||||
kind: Client
|
||||
matchName: {{ .client }}
|
||||
realm:
|
||||
apiVersion: realm.keycloak.crossplane.io/v1alpha1
|
||||
kind: Realm
|
||||
matchName: {{ .realm }}
|
||||
{{ end }}
|
||||
{{ if and (ne .observed.resources nil) (ne .extraResources nil) }}
|
||||
{{ range $i, $serviceAccountRole := .observed.composite.resource.spec.serviceAccountRoles }}
|
||||
{{ $client := (index (index $.extraResources "client").items $i).resource }}
|
||||
{{ $realm := (index (index $.extraResources "realm").items $i).resource }}
|
||||
---
|
||||
apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
|
||||
kind: ClientServiceAccountRole
|
||||
metadata:
|
||||
annotations:
|
||||
gotemplating.fn.crossplane.io/composition-resource-name: {{ $.observed.composite.resource.metadata.name }}-{{ .role }}
|
||||
spec:
|
||||
forProvider:
|
||||
clientId: {{ $client.status.atProvider.id }}
|
||||
realmId: {{ $realm.status.atProvider.id }}
|
||||
role: {{ $serviceAccountRole.role }}
|
||||
serviceAccountUserId: {{ ( index $.observed.resources $.observed.composite.resource.metadata.name ).resource.status.atProvider.serviceAccountUserId | default "null" }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
- step: automatically-detect-ready-composed-resources
|
||||
functionRef:
|
||||
name: function-auto-ready
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- keycloak-builtin-objects.yaml
|
||||
- keycloak-oidc-client.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: pkg.crossplane.io/v1beta1
|
||||
kind: Function
|
||||
metadata:
|
||||
name: function-auto-ready
|
||||
spec:
|
||||
package: xpkg.upbound.io/crossplane-contrib/function-auto-ready:v0.4.2 # renovate: github-releases=crossplane-contrib/function-auto-ready
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: pkg.crossplane.io/v1beta1
|
||||
kind: Function
|
||||
metadata:
|
||||
name: function-extra-resources
|
||||
spec:
|
||||
package: xpkg.upbound.io/crossplane-contrib/function-extra-resources:v0.0.3 # renovate: github-releases=crossplane-contrib/function-extra-resources
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: pkg.crossplane.io/v1beta1
|
||||
kind: Function
|
||||
metadata:
|
||||
name: function-go-templating
|
||||
spec:
|
||||
package: xpkg.upbound.io/crossplane-contrib/function-go-templating:v0.9.2 # renovate: github-releases=crossplane-contrib/function-go-templating
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: pkg.crossplane.io/v1beta1
|
||||
kind: Function
|
||||
metadata:
|
||||
name: function-keycloak-builtin-objects
|
||||
spec:
|
||||
package: registry.gitlab.com/corewire/images/crossplane/function-keycloak-builtin-objects:v3.0.1 # renovate: gitlab-releases=corewire/images/crossplane/function-keycloak-builtin-objects
|
||||
packagePullPolicy: Always
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- auto-ready.yaml
|
||||
- extra-resources.yaml
|
||||
- go-templating.yaml
|
||||
- keycloak-builtin-objects.yaml
|
||||
@@ -1,9 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
commonLabels:
|
||||
dev.stonegarden: crossplane-crds
|
||||
app.kubernetes.io/managed-by: argocd
|
||||
|
||||
resources:
|
||||
- project.yaml
|
||||
- application-set.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: crossplane-crds
|
||||
namespace: argocd
|
||||
spec:
|
||||
sourceRepos:
|
||||
- 'https://github.com/vehagn/homelab'
|
||||
destinations:
|
||||
- namespace: 'argocd'
|
||||
server: '*'
|
||||
- namespace: 'crossplane'
|
||||
server: '*'
|
||||
clusterResourceWhitelist:
|
||||
- group: '*'
|
||||
kind: '*'
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: pkg.crossplane.io/v1
|
||||
kind: Provider
|
||||
metadata:
|
||||
name: provider-keycloak
|
||||
spec:
|
||||
package: xpkg.upbound.io/crossplane-contrib/provider-keycloak:v2.0.0 # renovate: github-releases=crossplane-contrib/provider-keycloak
|
||||
@@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- keycloak.yaml
|
||||
@@ -1,56 +0,0 @@
|
||||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: CompositeResourceDefinition
|
||||
metadata:
|
||||
name: xbuiltinobjects.keycloak.crossplane.io
|
||||
spec:
|
||||
group: keycloak.crossplane.io
|
||||
names:
|
||||
kind: XBuiltinObjects
|
||||
plural: xbuiltinobjects
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
referenceable: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
realm:
|
||||
type: string
|
||||
description: Realm to import the builtin clients/roles from
|
||||
builtinClients:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: List of clients to import from the realm
|
||||
builtinRealmRoles:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
enum:
|
||||
- offline_access
|
||||
- uma_authorization
|
||||
- admin
|
||||
- create-realm
|
||||
- default-roles-master
|
||||
description: List of realm roles to import from the realm
|
||||
builtinAuthenticationFlows:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: List of authentication flows to import from the realm
|
||||
providerConfigName:
|
||||
type: string
|
||||
description: Name of the provider config to attach to the imported clients/roles
|
||||
providerSecretName:
|
||||
type: string
|
||||
description: Name of the secret containing the provider credentials (Secret must have a label with key=type and value=provider-credentials to be found)
|
||||
required:
|
||||
- providerConfigName
|
||||
- providerSecretName
|
||||
- realm
|
||||
required:
|
||||
- spec
|
||||
@@ -1,110 +0,0 @@
|
||||
apiVersion: apiextensions.crossplane.io/v1
|
||||
kind: CompositeResourceDefinition
|
||||
metadata:
|
||||
name: xoidcclients.oidc.homelab.olav.ninja
|
||||
spec:
|
||||
group: oidc.homelab.olav.ninja
|
||||
names:
|
||||
kind: XOidcClient
|
||||
plural: xoidcclients
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
served: true
|
||||
referenceable: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
properties:
|
||||
spec:
|
||||
type: object
|
||||
properties:
|
||||
baseUrl:
|
||||
description: Default URL to use when the auth server needs to
|
||||
redirect or link back to the client.
|
||||
type: string
|
||||
displayName:
|
||||
type: string
|
||||
description: The display name of this client in the GUI
|
||||
clientId:
|
||||
type: string
|
||||
description: The Client ID for this client, referenced in the URI during authentication and in issued tokens
|
||||
clientSecretSecretRef:
|
||||
description: |-
|
||||
The client or client secret registered within the identity provider. This field is able to obtain its value from vault, use $${vault.ID} format.
|
||||
Client Secret.
|
||||
properties:
|
||||
key:
|
||||
description: The key to select.
|
||||
type: string
|
||||
name:
|
||||
description: Name of the secret.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace of the secret.
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
- namespace
|
||||
type: object
|
||||
description:
|
||||
type: string
|
||||
description: The description of this client in the GUI
|
||||
defaultScopes:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: |-
|
||||
The default scopes to be requested when asking for authorization
|
||||
grantTypes:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: |-
|
||||
A list of grant types that should be enabled for the client
|
||||
postLogoutRedirectUris:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: A list of valid URIs a browser is permitted to redirect
|
||||
to after a successful logout.
|
||||
realm:
|
||||
type: string
|
||||
description: The realm this client is attached to
|
||||
redirectUris:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: |-
|
||||
A list of valid URIs a browser is permitted to redirect to after a successful login or logout. Simple
|
||||
wildcards in the form of an asterisk can be used here. This attribute must be set if either standard_flow_enabled or implicit_flow_enabled
|
||||
is set to true.
|
||||
serviceAccountRoles:
|
||||
type: array
|
||||
items:
|
||||
type: object
|
||||
properties:
|
||||
client:
|
||||
type: string
|
||||
realm:
|
||||
type: string
|
||||
role:
|
||||
type: string
|
||||
description: |-
|
||||
A list of roles to assign to the clients service account
|
||||
type:
|
||||
type: string
|
||||
description: Specifies the type of client
|
||||
webOrigins:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: |-
|
||||
A list of allowed CORS origins. To permit all valid
|
||||
redirect URIs, add +. Note that this will not include the *
|
||||
wildcard. To permit all origins, explicitly add *.
|
||||
required:
|
||||
- clientId
|
||||
- realm
|
||||
required:
|
||||
- spec
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- keycloak-builtin-objects.yaml
|
||||
- keycloak-oidc-client.yaml
|
||||
Reference in New Issue
Block a user