@ -1,215 +1,208 @@
---
- name : "Login with keycloak-admin"
include_role:
name : keycloak
tasks_from : _authenticate
args:
apply:
tags:
- argo-cd
when:
- k8s_argocd_with_keycloak
tags:
- argo-cd
- name : "Setup keycloak-realm for argocd"
include_role:
name : keycloak
tasks_from : _configure_realm
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_display_name : '{{ argo_realm_display_name }}'
create_client : False
current_realm_password_policy : ''
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Do some stuff with keycloak as OIDC provider"
block:
- name : "Login with keycloak-admin"
include_role:
name : keycloak
tasks_from : _authenticate
args:
apply:
tags:
- argo-cd
when:
tags:
- argo-cd
- name : "Create a Keycloak group, authentication with credentials"
include_role:
name : keycloak
tasks_from : _create_realm_groups
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_display_name : '{{ argo_realm_display_name }}'
current_realm_groups:
- name : "{{ argo_realm_group }}"
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Setup keycloak-realm for argocd"
include_role:
name : keycloak
tasks_from : _configure_realm
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_display_name : '{{ argo_realm_display_name }}'
create_client : False
current_realm_password_policy : ''
when:
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Create keycloak user(s)"
include_role:
name : keycloak
tasks_from : _create_realm_users
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_users : '{{ argo_realm_users }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Create a Keycloak group, authentication with credentials"
include_role:
name : keycloak
tasks_from : _create_realm_groups
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_display_name : '{{ argo_realm_display_name }}'
current_realm_groups:
- name : "{{ argo_realm_group }}"
when:
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "ADD user group mapping"
include_role:
name : keycloak
tasks_from : _configure_user_groupmembership_crud
vars:
username : '{{ argocd_admin_username }}'
destination_group : '{{ argo_realm_group }}'
realm_name : '{{ argo_realm_name }}'
bearer_token : '{{ access_token }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Create keycloak user(s)"
include_role:
name : keycloak
tasks_from : _create_realm_users
vars:
current_realm_name : '{{ argo_realm_name }}'
current_realm_users : '{{ argo_realm_users }}'
when:
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
- name : "Create keycloak clientscope"
delegate_to : localhost
become : False
community.general.keycloak_clientscope:
auth_client_id : admin-cli
auth_keycloak_url : "{{ keycloak_server_url }}/auth"
auth_realm : 'master'
auth_username : "{{ keycloak_admin_username }}"
auth_password : "{{ keycloak_admin_password }}"
name : '{{ argo_keycloak_clientscope_name }}'
realm : '{{ argo_realm_name }}'
protocol : '{{ argo_keycloak_clientscope_protocol }}'
protocol_mappers:
- config:
access.token.claim : True
claim.name : '{{ argo_keycloak_clientscope_name }}'
full.path : False # set it to true and you will be DAMNED => groupname for argo k8s configmap argocd-rbac-cm will be "/{{ group_name }}" !!!! instead of "{{ group_name }}"
id.token.claim : True
userinfo.token.claim : True
name : '{{ argo_keycloak_clientscope_name }}'
protocol : openid-connect
protocolMapper : oidc-group-membership-mapper
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name : "ADD user group mapping"
include_role:
name : keycloak
tasks_from : _configure_user_groupmembership_crud
vars:
username : '{{ argocd_admin_username }}'
destination_group : '{{ argo_realm_group }}'
realm_name : '{{ argo_realm_name }}'
bearer_token : '{{ access_token }}'
when:
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
# using template from exported keycloak client object
# due to needed params but missing in community.general.keycloak_client
# e.g. defaultClientScopes
- name : "Create json object as VAR from template"
set_fact:
keycloak_realm_create_client : "{{ lookup('template','keycloak-realm-create-client-argocd.json.j2') }}"
vars:
client_redirect_uri : '{{ argo_client_redirect_uris }}'
client_web_origins : '{{ argo_client_web_origins }}'
client_id : '{{ argo_client_id }}'
realm_name : '{{ argo_realm_name }}'
client_root_url : '{{ argo_client_root_url }}'
client_admin_url : '{{ argo_client_admin_url }}'
client_base_url : '{{ argo_client_base_url }}'
keycloak_clientscope_name : '{{ argo_keycloak_clientscope_name }}'
keycloak_clientscope_protocol : '{{ argo_keycloak_clientscope_protocol }}'
keycloak_client_secret : '{{ argo_keycloak_client_secret }}'
when:
- k8s_argocd_with_keycloak
tags:
- argo-cd
- name : "Create keycloak clientscope"
delegate_to : localhost
become : False
community.general.keycloak_clientscope:
auth_client_id : admin-cli
auth_keycloak_url : "{{ keycloak_server_url }}/auth"
auth_realm : 'master'
auth_username : "{{ keycloak_admin_username }}"
auth_password : "{{ keycloak_admin_password }}"
name : '{{ argo_keycloak_clientscope_name }}'
realm : '{{ argo_realm_name }}'
protocol : '{{ argo_keycloak_clientscope_protocol }}'
protocol_mappers:
- config:
access.token.claim : True
claim.name : '{{ argo_keycloak_clientscope_name }}'
full.path : False # set it to true and you will be DAMNED => groupname for argo k8s configmap argocd-rbac-cm will be "/{{ group_name }}" !!!! instead of "{{ group_name }}"
id.token.claim : True
userinfo.token.claim : True
name : '{{ argo_keycloak_clientscope_name }}'
protocol : openid-connect
protocolMapper : oidc-group-membership-mapper
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# throw needed VARs against keycloak API
# to CRUD
- name : "Create client"
include_role:
name : keycloak
tasks_from : _configure_client_crud
vars:
client_id : '{{ argo_client_id }}'
realm_name : '{{ argo_realm_name }}'
keycloak_client_object : '{{ keycloak_realm_create_client }}'
bearer_token : '{{ access_token }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
# using template from exported keycloak client object
# due to needed params but missing in community.general.keycloak_client
# e.g. defaultClientScopes
- name : "Create json object as VAR from template"
set_fact:
keycloak_realm_create_client : "{{ lookup('template','keycloak-realm-create-client-argocd.json.j2') }}"
vars:
client_redirect_uri : '{{ argo_client_redirect_uris }}'
client_web_origins : '{{ argo_client_web_origins }}'
client_id : '{{ argo_client_id }}'
realm_name : '{{ argo_realm_name }}'
client_root_url : '{{ argo_client_root_url }}'
client_admin_url : '{{ argo_client_admin_url }}'
client_base_url : '{{ argo_client_base_url }}'
keycloak_clientscope_name : '{{ argo_keycloak_clientscope_name }}'
keycloak_clientscope_protocol : '{{ argo_keycloak_clientscope_protocol }}'
keycloak_client_secret : '{{ argo_keycloak_client_secret }}'
tags:
- argo-cd
- name : "GET available clients from <<{{ argo_realm_name }}>>-realm"
delegate_to : localhost
become : False
uri:
url : "{{ keycloak_server_url }}/auth/admin/realms/{{ argo_realm_name }}/clients"
method : GET
headers:
Content-Type : "application/json"
Authorization : "Bearer {{ access_token }}"
status_code : [ 200 ]
register : argo_realm_clients
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# throw needed VARs against keycloak API
# to CRUD
- name : "Create client"
include_role:
name : keycloak
tasks_from : _configure_client_crud
vars:
client_id : '{{ argo_client_id }}'
realm_name : '{{ argo_realm_name }}'
keycloak_client_object : '{{ keycloak_realm_create_client }}'
bearer_token : '{{ access_token }}'
when:
- inventory_hostname == groups['kube_control_plane'][0]
args:
apply:
tags:
- argo-cd
tags:
- argo-cd
# available clients: get needed ID
- name : "Get ID of client by paring argo_realm_clients object"
set_fact:
id_of_client : '{{ ( argo_realm_clients.json | selectattr("clientId","equalto",argo_client_id ) | first ).id }}'
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name : "GET available clients from <<{{ argo_realm_name }}>>-realm"
delegate_to : localhost
become : False
uri:
url : "{{ keycloak_server_url }}/auth/admin/realms/{{ argo_realm_name }}/clients"
method : GET
headers:
Content-Type : "application/json"
Authorization : "Bearer {{ access_token }}"
status_code : [ 200 ]
register : argo_realm_clients
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name : "GET client-secret for client <<{{ argo_client_id }}>> in realm <<{{ argo_realm_name }}>>"
delegate_to : localhost
become : False
uri:
url : "{{ keycloak_server_url }}/auth/admin/realms/{{ argo_realm_name }}/clients/{{ id_of_client }}/client-secret"
method : GET
headers:
Content-Type : "application/json"
Authorization : "Bearer {{ access_token }}"
status_code : [ 200 ]
register : client_secret
when:
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# available clients: get needed ID
- name : "Get ID of client by paring argo_realm_clients object"
set_fact:
id_of_client : '{{ ( argo_realm_clients.json | selectattr("clientId","equalto",argo_client_id ) | first ).id }}'
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name : "DEBUG"
debug:
msg : "DEBUGGING: {{ client_secret.json.value }}"
- name : "GET client-secret for client <<{{ argo_client_id }}>> in realm <<{{ argo_realm_name }}>>"
delegate_to : localhost
become : False
uri:
url : "{{ keycloak_server_url }}/auth/admin/realms/{{ argo_realm_name }}/clients/{{ id_of_client }}/client-secret"
method : GET
headers:
Content-Type : "application/json"
Authorization : "Bearer {{ access_token }}"
status_code : [ 200 ]
register : client_secret
when:
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
- name : "DEBUG"
debug:
msg : "DEBUGGING: {{ client_secret.json.value }}"
when:
- debug
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
when:
- debug
- k8s_argocd_with_keycloak
- inventory_hostname == groups['kube_control_plane'][0]
tags:
- argo-cd
# end of block statement
- name : "Create namespace <{{ k8s_argocd_helm__release_namespace }}>"
become : yes
Görz, Friedrich
3 years ago
committed by
Ketelsen, Sven