helm-keycloak-gatekeeper

A helm chart for installing an OpenID Connect authenticating proxy in front of your HTTP services. Based on the excellent keycloak/keycloak-gatekeeper.

How it works

This charts installs a service, and optionally also an ingress, that sits between a service (e.g. an internal ClusterIP service) and its clients, allowing incoming requests only if they've been authenticated by an OIDC provider of your choice.

Example configuration

The following values.yaml lets you protect requests to the in-cluster service my-service, given a proper configuration of your IdP (e.g. registration of the my-service client, generation of a client-secret, etc):

upstreamUrl: "http://my-service:8080"

oidc:
  clientId: "my-service"
  clientSecret: "theSecretGeneratedByTheIdP"
  discoveryUrl: "https://idp.example.com/"

ingress:
  enabled: true
  annotations:
    kubernetes.io/tls-acme: "true"
  path: /
  hosts:
  - my-service.example.com
  tls:
  - secretName: tls-my-service
    hosts:
    - my-service.example.com

Check out values.yaml for other options tha are configurable in this chart.

Future work

• Expose distributed caching flags, already implemented in keycloak/keycloak-gatekeeper (e.g. --store-url=redis://127.0.0.1:6379)
• Expose optional prometheus endpoint, through flags and proper pod/service configuration
• Expose tags flag, for configuring the forbidden/login templates
• Add option for specifying the redirect URL e.g. for logouts