Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: upgrade RH-SSO from 7.5 to 7.6 #977

Merged
merged 3 commits into from
Aug 28, 2023
Merged

feat: upgrade RH-SSO from 7.5 to 7.6 #977

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
919def2
upgrade RH-SSO from 7.5 to 7.6
iam-veeramalla Aug 24, 2023
2b9965a
fix: failing tests
iam-veeramalla Aug 24, 2023
45d315e
fix: failing tests
iam-veeramalla Aug 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions common/defaults.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,11 +183,11 @@ const (
ArgoCDKeycloakVersion = "sha256:64fb81886fde61dee55091e6033481fa5ccdac62ae30a4fd29b54eb5e97df6a9"

// ArgoCDKeycloakImageForOpenShift is the default Keycloak Image used for the OpenShift platform when not specified.
ArgoCDKeycloakImageForOpenShift = "registry.redhat.io/rh-sso-7/sso75-openshift-rhel8"
ArgoCDKeycloakImageForOpenShift = "registry.redhat.io/rh-sso-7/sso76-openshift-rhel8"

// ArgoCDKeycloakVersionForOpenShift is the default Keycloak version used for the OpenShift platform when not specified.
// Version: 7.5.1
ArgoCDKeycloakVersionForOpenShift = "sha256:720a7e4c4926c41c1219a90daaea3b971a3d0da5a152a96fed4fb544d80f52e3"
// Version: 7.6-25
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@iam-veeramalla should this be 7.6.25?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the version is mentioned as 7.6-25.

ArgoCDKeycloakVersionForOpenShift = "sha256:bb6dc12a49370ba6baa40cfa064238cddcfd1edb22c37dcdf53d331c0f7ee15d"

// ArgoCDDefaultOIDCConfig is the default OIDC configuration.
ArgoCDDefaultOIDCConfig = ""
Expand Down
19 changes: 16 additions & 3 deletions controllers/argocd/keycloak.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,7 @@ func getKeycloakContainer(cr *argoprojv1a1.ArgoCD) corev1.Container {
Image: getKeycloakContainerImage(cr),
ImagePullPolicy: "Always",
LivenessProbe: &corev1.Probe{
FailureThreshold: 3,
TimeoutSeconds: 120,
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Command: []string{
Expand All @@ -302,7 +302,7 @@ func getKeycloakContainer(cr *argoprojv1a1.ArgoCD) corev1.Container {
{ContainerPort: 8888, Name: "ping", Protocol: "TCP"},
},
ReadinessProbe: &corev1.Probe{
FailureThreshold: 20,
TimeoutSeconds: 120,
ProbeHandler: corev1.ProbeHandler{
Exec: &corev1.ExecAction{
Command: []string{
Expand All @@ -312,7 +312,6 @@ func getKeycloakContainer(cr *argoprojv1a1.ArgoCD) corev1.Container {
},
},
},
InitialDelaySeconds: 60,
},
Resources: getKeycloakResources(cr),
VolumeMounts: []corev1.VolumeMount{
Expand All @@ -326,12 +325,18 @@ func getKeycloakContainer(cr *argoprojv1a1.ArgoCD) corev1.Container {
Name: "service-ca",
ReadOnly: true,
},
{
Name: "sso-probe-netrc-volume",
MountPath: "/mnt/rh-sso",
ReadOnly: false,
},
},
}
}

func getKeycloakDeploymentConfigTemplate(cr *argoprojv1a1.ArgoCD) *appsv1.DeploymentConfig {
ns := cr.Namespace
var medium corev1.StorageMedium = "Memory"
keycloakContainer := getKeycloakContainer(cr)

dc := &appsv1.DeploymentConfig{
Expand Down Expand Up @@ -401,6 +406,14 @@ func getKeycloakDeploymentConfigTemplate(cr *argoprojv1a1.ArgoCD) *appsv1.Deploy
},
},
},
{
Name: "sso-probe-netrc-volume",
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{
Medium: medium,
},
},
},
},
NodeSelector: common.DefaultNodeSelector(),
},
Expand Down
12 changes: 10 additions & 2 deletions controllers/argocd/keycloak_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,14 @@ var (
},
},
},
{
Name: "sso-probe-netrc-volume",
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{
Medium: "Memory",
},
},
},
}
)

Expand Down Expand Up @@ -107,7 +115,7 @@ func TestKeycloakContainerImage(t *testing.T) {
}),
updateCrFunc: nil,
templateAPIFound: true,
wantContainerImage: "registry.redhat.io/rh-sso-7/sso75-openshift-rhel8@sha256:720a7e4c4926c41c1219a90daaea3b971a3d0da5a152a96fed4fb544d80f52e3",
wantContainerImage: "registry.redhat.io/rh-sso-7/sso76-openshift-rhel8@sha256:bb6dc12a49370ba6baa40cfa064238cddcfd1edb22c37dcdf53d331c0f7ee15d",
},
{
name: "ArgoCDKeycloakImageEnvName env var set",
Expand Down Expand Up @@ -243,7 +251,7 @@ func TestNewKeycloakTemplate_testKeycloakContainer(t *testing.T) {
}
kc := getKeycloakContainer(a)
assert.Equal(t,
"registry.redhat.io/rh-sso-7/sso75-openshift-rhel8@sha256:720a7e4c4926c41c1219a90daaea3b971a3d0da5a152a96fed4fb544d80f52e3", kc.Image)
"registry.redhat.io/rh-sso-7/sso76-openshift-rhel8@sha256:bb6dc12a49370ba6baa40cfa064238cddcfd1edb22c37dcdf53d331c0f7ee15d", kc.Image)
assert.Equal(t, corev1.PullAlways, kc.ImagePullPolicy)
assert.Equal(t, "${APPLICATION_NAME}", kc.Name)
}
Expand Down
2 changes: 1 addition & 1 deletion docs/reference/argocd.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1539,7 +1539,7 @@ The following properties are available for configuring Keycloak Single sign-on p
Name | Default | Description
--- | --- | ---
Image | OpenShift - `registry.redhat.io/rh-sso-7/sso75-openshift-rhel8` <br/> Kuberentes - `quay.io/keycloak/keycloak` | The container image for keycloak. This overrides the `ARGOCD_KEYCLOAK_IMAGE` environment variable.
Image | OpenShift - `registry.redhat.io/rh-sso-7/sso76-openshift-rhel8` <br/> Kuberentes - `quay.io/keycloak/keycloak` | The container image for keycloak. This overrides the `ARGOCD_KEYCLOAK_IMAGE` environment variable.
Resources | `Requests`: CPU=500m, Mem=512Mi, `Limits`: CPU=1000m, Mem=1024Mi | The container compute resources.
RootCA | "" | root CA certificate for communicating with the OIDC provider
VerifyTLS | true | Whether to enforce strict TLS checking when communicating with Keycloak service.
Expand Down
8 changes: 6 additions & 2 deletions examples/argocd-keycloak-openshift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,14 @@ kind: ArgoCD
metadata:
name: example-argocd
spec:
extraConfig:
oidc.tls.insecure.skip.verify: 'true'
sso:
provider: keycloak
# uncomment the below line when running operator locally.
# verifyTLS: false
keycloak:
rootCA: "---BEGIN---END---"
# Uncomment the below line when running operator locally.
# verifyTLS: false
server:
route:
enabled: true
2 changes: 1 addition & 1 deletion tests/ocp/1-001_validate_rhsso/01-assert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ spec:
name: keycloak
spec:
containers:
- image: registry.redhat.io/rh-sso-7/sso75-openshift-rhel8@sha256:720a7e4c4926c41c1219a90daaea3b971a3d0da5a152a96fed4fb544d80f52e3
- image: registry.redhat.io/rh-sso-7/sso76-openshift-rhel8@sha256:bb6dc12a49370ba6baa40cfa064238cddcfd1edb22c37dcdf53d331c0f7ee15d
resources:
limits:
cpu: "1"
Expand Down