olb42/login
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8 Commits 1 Branch 0 Tags
main
Commit Graph
8 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
olb042 a2036c8381 fix: proxy.headers xforwarded not forwarded - Traefik sends X-Forwarded-* headers
Validate login GitOps repo / validate (push) Successful in 18s
Details 
Keycloak was seeing requests as non-secure (HTTP) because it was expecting
the RFC 7239 Forwarded: header but Traefik sends X-Forwarded-Proto/For/Host.
This caused CSP failures and cookie security warnings.
 2026-05-11 00:27:13 +01:00
olb042 716ad61115 fix: remove hostname.admin field - not a valid URL format in KC v26
Validate login GitOps repo / validate (push) Successful in 12s
Details 
Keycloak v26 hostname-admin expects a full URL (https://...) not bare hostname.
Dropping it so KC defaults admin to the same as the main hostname.
 2026-05-11 00:15:50 +01:00
olb042 8fa904bb6c fix: add RBAC for keycloak-operator SA to manage resources in login namespace
Validate login GitOps repo / validate (push) Successful in 10s
Details 
The upstream operator RBAC is scoped to keycloak-system only. With
QUARKUS_OPERATOR_SDK_NAMESPACES=login the operator tries to watch/manage
resources in login, so it needs a matching Role + RoleBindings there:
- keycloak-operator-role: core resources (statefulsets, secrets, services, etc)
- keycloakcontroller-cluster-role binding: keycloaks CRD access
- keycloakrealmimportcontroller-cluster-role binding: realm import CRD access
 2026-05-11 00:11:08 +01:00
olb042 648c7f0266 fix: use correct QUARKUS_OPERATOR_SDK_NAMESPACES env var for operator namespace watch
Validate login GitOps repo / validate (push) Successful in 12s
Details 
WATCH_NAMESPACES is not a JOSDK env var. The Quarkus JOSDK extension reads
QUARKUS_OPERATOR_SDK_NAMESPACES (maps to quarkus.operator-sdk.namespaces).

Also: update CNPG anti-affinity topology key from kubernetes.io/hostname to
topology.kubernetes.io/zone to spread primary and replica across pve-1 / pve-2.
 2026-05-11 00:06:33 +01:00
olb042 746c50ae0a fix: bootstrapAdmin.user.secret is a string, not a nested object
Validate login GitOps repo / validate (push) Successful in 11s
Details
2026-05-10 23:16:52 +01:00
olb042 67b1916012 fix: three blocking issues preventing login stack from starting
Validate login GitOps repo / validate (push) Successful in 11s
Details 
- keycloak-instance: bootstrapAdminSpec -> bootstrapAdmin (correct CRD field)
- cnpg-cluster: remove barman-cloud plugin block (BarmanObjectStore CRD absent)
- operator/kustomization: patch WATCH_NAMESPACES=login so operator reconciles login ns
 2026-05-10 23:14:56 +01:00
olb042 59e56be3e5 add sealed secret
Validate login GitOps repo / validate (push) Successful in 10s
Details
2026-05-10 22:58:07 +01:00
olb042 6f29be2987 feat: initial scaffold from helm-template
Validate login GitOps repo / validate (push) Successful in 9s
Details 
- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login
 2026-05-10 22:32:49 +01:00