feat: create keycloak service account and rbac

charts/keycloak/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: sso-keycloak
-version: 1.15.1
+version: 1.15.2
 appVersion: 7.6.39-build.1
 description: Open Source Identity and Access Management For Modern Applications and Services
 dependencies:

charts/keycloak/templates/_helpers.tpl

@@ -82,3 +82,14 @@ Maintenance Selector labels
 app.kubernetes.io/name: {{ include "sso-keycloak.name" . }}-maintenance
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "sso-keycloak.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "sso-keycloak.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/keycloak/templates/deployment.yaml

@@ -50,7 +50,7 @@ spec:
                 echo "Waiting for StatefulSet {{ .Values.patroni.nameOverride }} rollout to complete..."
                 sleep 5
               done
-
+      serviceAccountName: {{ include "sso-keycloak.serviceAccountName" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/keycloak/templates/rbac.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "sso-keycloak.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "sso-keycloak.fullname" . }}
+---
+{{- end }}

charts/keycloak/templates/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+{{- end }}

charts/keycloak/values.yaml

@@ -122,6 +122,13 @@ podDisruptionBudget:
   minAvailable:
   maxUnavailable:
 
+serviceAccount:
+  create: true
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
 patroni:
   replicaCount: 3
   # RH-SSO v7.5-9 is not tested with PostgreSQL 14