Add keycloak to a k8s cluster via helm

Overview

Add ability for external service authentication. The process below discusses how to install and authenticate with self-hosted keycloak OAuth2 endpoints.

Prerequisites

• A k8s cluster
• The config.yaml file for the Jupyterhub helm chart

Process

Add the keycloak helm chart repo.

$ helm repo add codecentric https://codecentric.github.io/helm-charts
$ helm repo update

Install keycloak, specifying a httpPort different from the default of 80 (the jupyterhub service requires that the inbound port be port 80 or 443, otherwise it doesn't work correctly).

$ helm install keycloak codecentric/keycloak --set keycloak.service.httpPort=8080

Get the keycloak admin user password.

$ kubectl get secret --namespace default keycloak-http -o jsonpath="{.data.password}" | base64 --decode; echo

Forward the exposed keycloak port from service to k8s master.

$ kubectl port-forward -n default keycloak-0 8080:8080

Forward the port from the k8s master to your own host.

$ sudo ssh -L 8080:127.0.0.1:8080 -Nfl USERNAME HOSTNAME

where:

• USERNAME is your username
• HOSTNAME is the host name of the k8s master

Point internal cluster hostname to loopback on your own localhost. This step is mandatory. From your browser, the location of the keycloak instance needs to be the same as the location from within the cluster network. Within the network, the service is accessed from keycloak-http.default.svc.cluster.local. Outside the network, without adding an entry to /etc/hosts, the location is only accessible from localhost.

Edit /etc/hosts

$ sudo vi /etc/hosts

adding a new entry:

127.0.0.1   keycloak-http.default.svc.cluster.local

Set up the keycloak instance:

1. Set up the keycloak realm/client.
2. Navigate to http://localhost:8080 and login as "keycloak" (password above)
3. Create realm called "test"
4. Add new client to "test" realm called "test"
5. Change the "access type" to "confidential", which makes the client accessible only via a secret
6. Change the "redirect-URIs" to http://localhost/*, otherwise you will get a CORS error
7. Save
8. Navigate to credentials tab and make a note of the client secret
9. Add new user to the client called "testuser" and assign a password of "password" (or whichever user you want to log in as)

Verify the user login works.

$ http://localhost:8080/auth/realms/jhub/account

Endpoints: http://localhost:9000/auth/realms/jhub/.well-known/openid-configuration