scott
73701b4a34
- LookupConfig: ssl-client-cert / ssl-cert-chain-prefix / certificate-chain-length now fall back to the built-in nginx provider's settings (Config scope, then KC_SPI_X509CERT_LOOKUP_NGINX_* env vars), so switching the provider to "hybrid" needs no duplicated Helm values. Explicit hybrid-scope settings still override. - Add LookupConfigTest covering inheritance, override, and defaults (14 tests total, all passing). - Add RUNBOOK.md: phase-by-phase deployment procedure sized to 30-min test windows, with verification checklists, forged-header negative test, rollback per phase, and failure triage table. - README/Dockerfile.example updated to match; stop tracking target/ build output (.gitignore added). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
1.2 KiB
Docker
28 lines
1.2 KiB
Docker
# Example: adding the hybrid x509 SPI to a custom Keycloak image.
|
|
# Merge these lines into your EXISTING Dockerfile — keep your current base tag,
|
|
# build options (KC_DB, KC_FEATURES, ...), and entrypoint.
|
|
|
|
FROM quay.io/keycloak/keycloak:26.0 AS builder
|
|
|
|
COPY target/keycloak-hybrid-x509-spi-1.0.0.jar /opt/keycloak/providers/
|
|
|
|
# Build-time option: must be set before `kc.sh build` (runtime-only won't work
|
|
# for images started with --optimized). `request` = client cert OPTIONAL.
|
|
ENV KC_HTTPS_CLIENT_AUTH=request
|
|
|
|
RUN /opt/keycloak/bin/kc.sh build
|
|
|
|
FROM quay.io/keycloak/keycloak:26.0
|
|
COPY --from=builder /opt/keycloak/ /opt/keycloak/
|
|
|
|
# Runtime config (usually set via Helm/manifest env instead of baked in):
|
|
# KC_SPI_X509CERT_LOOKUP_PROVIDER=hybrid
|
|
# (header name is inherited from your existing KC_SPI_X509CERT_LOOKUP_NGINX_* env
|
|
# vars — leave those in the Helm values as-is)
|
|
# KC_SPI_X509CERT_LOOKUP_HYBRID_TRUST_MODE=log # then 'enforce' after cycle 3
|
|
# KC_TRUSTSTORE_PATHS=/opt/keycloak/conf/truststores # CA bundle (KC 25+)
|
|
# KC_LOG_LEVEL=INFO,com.example.keycloak.x509:debug # during rollout
|
|
|
|
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
|
|
CMD ["start", "--optimized"]
|