homelab-v/k8s/infra/crossplane-crds/compositions/keycloak-oidc-client.yaml

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: keycloak-oidc-client
spec:
  compositeTypeRef:
    apiVersion: oidc.homelab.olav.ninja/v1alpha1
    kind: XOidcClient
  mode: Pipeline
  pipeline:
    - step: create-client
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
            kind: Client
            metadata:
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}
            spec:
              forProvider:
                name: {{ .observed.composite.resource.spec.displayName }}
                accessType: {{ .observed.composite.resource.spec.type }}
                clientId: {{ .observed.composite.resource.spec.clientId }}
                {{ with .observed.composite.resource.spec.clientSecretSecretRef }}
                clientSecretSecretRef: {{ toYaml . | nindent 6 }}
                {{ end }}
                description: {{ .observed.composite.resource.spec.description }}
                {{ with .observed.composite.resource.spec.baseUrl }}
                baseUrl: {{ . }}
                {{ end }}
                {{ with .observed.composite.resource.spec.redirectUris }}
                validRedirectUris: {{ toYaml . | nindent 6 }}
                {{ end }}
                {{ with .observed.composite.resource.spec.postLogoutRedirectUris }}
                validPostLogoutRedirectUris: {{ toYaml . | nindent 6 }}
                {{ end }}
                {{ with .observed.composite.resource.spec.webOrigins }}
                webOrigins: {{ toYaml . | nindent 6 }}
                {{ end }}
                {{ if has "client_credentials" .observed.composite.resource.spec.grantTypes }}
                serviceAccountsEnabled: true
                {{ end }}
                {{ if has "code" .observed.composite.resource.spec.grantTypes }}
                standardFlowEnabled: true
                {{ end }}
                {{ if has "device_code" .observed.composite.resource.spec.grantTypes }}
                oauth2DeviceAuthorizationGrantEnabled: true
                {{ end }}
                {{ if has "password" .observed.composite.resource.spec.grantTypes }}
                directAccessGrantsEnabled: true
                {{- end }}
                realmIdRef:
                  name: {{ .observed.composite.resource.spec.realm }}
    - step: create-audience-mapper
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            {{ if ne $.observed.resources nil }}
            apiVersion: client.keycloak.crossplane.io/v1alpha1
            kind: ProtocolMapper
            metadata:
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-audience-mapper
            spec:
              forProvider:
                name: Set token audience
                protocol: openid-connect
                protocolMapper: oidc-audience-mapper
                config:
                  included.client.audience: "{{ .observed.composite.resource.spec.clientId }}"
                  id.token.claim: "false"
                  access.token.claim: "true"
                  introspection.token.claim: "true"
                  userinfo.token.claim: "false"
                clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
                realmIdRef:
                  name: {{ .observed.composite.resource.spec.realm }}
            {{ end }}
    - step: create-usermodel-property-mapper
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            {{ if ne $.observed.resources nil }}
            apiVersion: client.keycloak.crossplane.io/v1alpha1
            kind: ProtocolMapper
            metadata:
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-sub-mapper
            spec:
              forProvider:
                name: Username as sub claim
                protocol: openid-connect
                protocolMapper: oidc-usermodel-property-mapper
                config:
                  user.attribute: username
                  id.token.claim: "true"
                  access.token.claim: "true"
                  claim.name: sub
                  userinfo.token.claim: "true"
                clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
                realmIdRef:
                  name: {{ .observed.composite.resource.spec.realm }}
            {{ end }}
    - step: create-client-default-scopes
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            {{ if ne $.observed.resources nil }}
            {{ if .observed.composite.resource.spec.defaultScopes }}
            apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
            kind: ClientDefaultScopes
            metadata:
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ .observed.composite.resource.metadata.name }}-default-scopes
            spec:
              forProvider:
                {{ with .observed.composite.resource.spec.defaultScopes }}
                defaultScopes: {{ toYaml . | nindent 6 }}
                {{ end }}
                clientId: {{ ( index .observed.resources .observed.composite.resource.metadata.name ).resource.status.atProvider.id | default "null" }}
                realmIdRef:
                  name: {{ .observed.composite.resource.spec.realm }}
            {{ end }}
            {{ end }}
    - step: create-service-account-role
      functionRef:
        name: function-go-templating
      input:
        apiVersion: gotemplating.fn.crossplane.io/v1beta1
        kind: GoTemplate
        source: Inline
        inline:
          template: |
            {{ range .observed.composite.resource.spec.serviceAccountRoles }}
            ---
            apiVersion: meta.gotemplating.fn.crossplane.io/v1alpha1
            kind: ExtraResources
            requirements:
              client:
                apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
                kind: Client
                matchName: {{ .client }}
              realm:
                apiVersion: realm.keycloak.crossplane.io/v1alpha1
                kind: Realm
                matchName: {{ .realm }}
            {{ end }}
            {{ if and (ne .observed.resources nil) (ne .extraResources nil) }}
            {{ range $i, $serviceAccountRole := .observed.composite.resource.spec.serviceAccountRoles }}
            {{ $client := (index (index $.extraResources "client").items $i).resource }}
            {{ $realm := (index (index $.extraResources "realm").items $i).resource }}
            ---
            apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
            kind: ClientServiceAccountRole
            metadata:
              annotations:
                gotemplating.fn.crossplane.io/composition-resource-name: {{ $.observed.composite.resource.metadata.name }}-{{ .role }}
            spec:
              forProvider:
                clientId: {{ $client.status.atProvider.id }}
                realmId: {{ $realm.status.atProvider.id }}
                role: {{ $serviceAccountRole.role }}
                serviceAccountUserId: {{ ( index $.observed.resources $.observed.composite.resource.metadata.name ).resource.status.atProvider.serviceAccountUserId | default "null" }}
            {{ end }}
            {{ end }}
    - step: automatically-detect-ready-composed-resources
      functionRef:
        name: function-auto-ready