Deploying Axual Governance on OpenShift

global:
  clusterDomain: "cluster.local"

  imageRegistry: "docker.axual.io"
  imagePullSecrets:
    - name: axualdockercred

  platform-manager:
    enabled: true

  platform-ui:
    enabled: true

  api-gateway:
    enabled: true

  organization-mgmt:
    enabled: true

  topic-browse:
    enabled: true

api-gateway:
  config:
    gateway:
      endpoints:
        platformManager:
          enabled: true
          url: "http://axual-governance-platform-manager"
        organizationManager:
          enabled: true
          url: "http://axual-governance-organization-mgmt"
        topicBrowse:
          enabled: true
          url: "http://axual-governance-topic-browse"
        billing:
          enabled: false
        metricsExposer:
          enabled: false
        platformUi:
          enabled: true
          url: "http://axual-governance-platform-ui"
        keycloak:
          enabled: true
          url: "http://keycloak:8080"

    topic-browse-config-api:
      url: "http://axual-governance-platform-manager/api/stream_configs/{id}/browse-config"
    permissions-api:
      url: "http://axual-governance-platform-manager/api/auth"

    local:
      auth:
        issuerUrlForValidation: https://axual-governance.apps-crc.testing/auth/realms/local
        jwkSetUri: http://keycloak:8080/auth/realms/local/protocol/openid-connect/certs
    sso:
      keycloak:
        advertisedBaseUrl: https://axual-governance.apps-crc.testing
        internalBaseUrl: http://keycloak:8080
        useInsecureTrustManager: true
    logging:
      filter:
        enabled: true

  route:
    enabled: true
    annotations: {}
    labels: {}
    host: "axual-governance.apps-crc.testing"
    path: "/"
    tls:
      termination: "edge"

platform-manager:
  debug:
    enabled: false
  image:
    pullPolicy: "Always"
  mtls:
    enabled: false
  config:
    spring:
      datasource:
        name: "fluxdb"
        url: "jdbc:mysql://axual-platform-manager-mysql:3306/selfservicedb?useSSL=false&useLegacyDatetimeCode=false&serverTimezone=UTC"
        username: "fluxmaster"
        password: "Passw0rd"
        driver-class-name: "com.mysql.cj.jdbc.Driver"
      jpa.database-platform: "org.hibernate.dialect.MySQLDialect"
      flyway:
        locations: "classpath:db/migration/mysql"
    axual:
      api.available.auth.methods: "SSL, SCRAM_SHA_512"
      instance-api:
        available: false
      operation-manager:
        available: false
      connect:
        available: false
      client:
        socket-timeout: 60000
      security:
        header-based-auth: true # Disable Keycloak and rely on headers passed from API Gateway
    governance:
      vault:
        enabled: false
        uri: "http://vault:8200"
        path: "governance"
        # Required: change to your roleId for PlatformManager, see step 9 above
        roleId: "744062d7-1d86-3496-bfdc-76f4d7352a2e"
        # Required: change to your secretId for PlatformManager, see step 9 above
        secretId: "634799b5-3ac7-ff6e-071f-a620243318fe"
    # Vault Configuration for Connectors
    vault:
      enabled: false
    azure:
      keyVault:
        enabled: false
    subscription-management:
      enabled: false
    server:
      ssl:
        enabled: false
      forward-headers-strategy: framework

platform-ui:
  platformManager:
    fqdn: "axual-governance.apps-crc.testing"

  # Window.ENV Configuration
  config:
    docsVersion: "2023.3"
    mgmtApiUrl: "https://axual-governance.apps-crc.testing/api"
    mgmtUiUrl: "https://axual-governance.apps-crc.testing/"
    organizationManagerUrl: "https://axual-governance.apps-crc.testing/api/organizations"
    topicBrowseUrl: 'https://axual-governance.apps-crc.testing/api/stream_configs'
    stripeBillingManagementUrl: "https://billing.stripe.com/p/login/test_00g15x1UV4hKcI8eUU"

    # Feature Flags
    billingEnabled: false
    insightsEnabled: false
    dataClassificationEnabled: false
    connectEnabled: false

    clientId: "self-service"
    clientSecret: "notSecret"
    configurationType: "remote"

    # Stream Browsing
    streamBrowseEnabled: false
    # This is for deciding on SB/CB(false) or TB(true)
    topicBrowseEnabled: true

    # Hide multiple environments
    singleEnvironmentEnabled: true
    organizationShortNameEditEnabled: true

    # Stripe Subscription
    subscriptionEnabled: false

    # Keycloak Configuration
    keycloakEnabled: true
    oidcScopes: "openid profile email"
    responseTypes: "code"
    oidcEndpoint: "https://axual-governance.apps-crc.testing"

    # Wizard Allowed Providers
    enabledKafkaProviders:
      - aiven
      - confluent_cloud
      - apache_kafka

organization-mgmt:
  config:
    authStrategy: "keycloak"
    keycloakDomain: "http://keycloak:8080"
    keycloakCLIUsername: "admin"
    keycloakCLIPassword: "admin"
    tlsVerification: false

kind: Template
apiVersion: template.openshift.io/v1
metadata:
  name: keycloak
  annotations:
    description: An example template for trying out Keycloak on OpenShift
    iconClass: icon-sso
    openshift.io/display-name: Keycloak
    tags: keycloak
    version: 23.0.3
objects:
  - apiVersion: v1
    kind: Service
    metadata:
      annotations:
        description: The web server's http port.
      labels:
        application: '${APPLICATION_NAME}'
      name: '${APPLICATION_NAME}'
    spec:
      ports:
        - port: 8080
          targetPort: 8080
      selector:
        deploymentConfig: '${APPLICATION_NAME}'
  - apiVersion: v1
    id: '${APPLICATION_NAME}'
    kind: Route
    metadata:
      annotations:
        description: Route for application's service.
      labels:
        application: '${APPLICATION_NAME}'
      name: '${APPLICATION_NAME}'
    spec:
      host: '${HOSTNAME}'
      tls:
        termination: edge
      to:
        name: '${APPLICATION_NAME}'
  - apiVersion: v1
    kind: DeploymentConfig
    metadata:
      labels:
        application: '${APPLICATION_NAME}'
      name: '${APPLICATION_NAME}'
    spec:
      replicas: 1
      selector:
        deploymentConfig: '${APPLICATION_NAME}'
      strategy:
        type: Recreate
      template:
        metadata:
          labels:
            application: '${APPLICATION_NAME}'
            deploymentConfig: '${APPLICATION_NAME}'
          name: '${APPLICATION_NAME}'
        spec:
          containers:
            - env:
                - name: KEYCLOAK_ADMIN
                  value: '${KEYCLOAK_ADMIN}'
                - name: KEYCLOAK_ADMIN_PASSWORD
                  value: '${KEYCLOAK_ADMIN_PASSWORD}'
                - name: KC_PROXY
                  value: 'edge'
                - name: KC_HTTP_RELATIVE_PATH
                  value: '/auth'
              image: quay.io/keycloak/keycloak:23.0.3
              livenessProbe:
                failureThreshold: 100
                httpGet:
                  path: /auth
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 60
              name: '${APPLICATION_NAME}'
              ports:
                - containerPort: 8080
                  protocol: TCP
              readinessProbe:
                failureThreshold: 300
                httpGet:
                  path: /auth
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 30
              securityContext:
                privileged: false
              volumeMounts:
                - mountPath: /opt/keycloak/data
                  name: empty
              args: ["start-dev"]
          volumes:
            - name: empty
              emptyDir: {}
      triggers:
        - type: ConfigChange
parameters:
  - name: APPLICATION_NAME
    displayName: Application Name
    description: The name for the application.
    value: keycloak
    required: true
  - name: KEYCLOAK_ADMIN
    displayName: Keycloak Administrator Username
    description: Keycloak Server administrator username
    generate: expression
    from: '[a-zA-Z0-9]{8}'
    required: true
  - name: KEYCLOAK_ADMIN_PASSWORD
    displayName: Keycloak Administrator Password
    description: Keycloak Server administrator password
    generate: expression
    from: '[a-zA-Z0-9]{8}'
    required: true
  - name: HOSTNAME
    displayName: Custom Route Hostname
    description: >-
      Custom hostname for the service route. Leave blank for default hostname,
      e.g.: <application-name>-<namespace>.<default-domain-suffix>
  - name: NAMESPACE
    displayName: Namespace used for DNS discovery
    description: >-
      This namespace is a part of DNS query sent to Kubernetes API. This query
      allows the DNS_PING protocol to extract cluster members. This parameter
      might be removed once https://issues.jboss.org/browse/JGRP-2292 is
      implemented.
    required: true

{
  "id": "03220395-8900-49d3-9763-268a528600ca",
  "realm": "local",
  "displayName": "Local",
  "displayNameHtml": "Local",
  "enabled": true,
  "registrationAllowed": true,
  "clients": [
    {
      "id": "3d03c347-f6cc-451b-9671-fce8b7ca3bfe",
      "clientId": "self-service",
      "name": "Self Service Client",
      "description": "Client used by the Self-Service to authenticate users",
      "rootUrl": "https://axual-governance.apps-crc.testing",
      "adminUrl": "https://axual-governance.apps-crc.testing",
      "baseUrl": "",
      "surrogateAuthRequired": false,
      "enabled": true,
      "alwaysDisplayInConsole": false,
      "clientAuthenticatorType": "client-secret",
      "redirectUris": [
        "*"
      ],
      "webOrigins": [
        "*"
      ],
      "notBefore": 0,
      "bearerOnly": false,
      "consentRequired": false,
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": true,
      "serviceAccountsEnabled": false,
      "publicClient": true,
      "frontchannelLogout": true,
      "protocol": "openid-connect",
      "attributes": {
        "oidc.ciba.grant.enabled": "false",
        "post.logout.redirect.uris": "*",
        "oauth2.device.authorization.grant.enabled": "false",
        "backchannel.logout.session.required": "true",
        "backchannel.logout.revoke.offline.tokens": "false"
      },
      "authenticationFlowBindingOverrides": {},
      "fullScopeAllowed": true,
      "nodeReRegistrationTimeout": -1,
      "protocolMappers": [
        {
          "id": "e2f65234-0851-4c56-aef8-e570571903cc",
          "name": "TenantShortName Mapper",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-attribute-mapper",
          "consentRequired": false,
          "config": {
            "introspection.token.claim": "true",
            "userinfo.token.claim": "true",
            "user.attribute": "tenant-short-name",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "claim.name": "tenant_short_name",
            "jsonType.label": "String"
          }
        },
        {
          "id": "9c6f38e8-483f-4f2f-bd15-19dc5462e77d",
          "name": "TenantName Mapper",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-attribute-mapper",
          "consentRequired": false,
          "config": {
            "introspection.token.claim": "true",
            "userinfo.token.claim": "true",
            "user.attribute": "tenant-name",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "claim.name": "tenant_name",
            "jsonType.label": "String"
          }
        }
      ]
    }
  ]
}