OpenShell/deploy/helm/openshell/ci/values-keycloak.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# OIDC configuration overlay for a local Keycloak instance in k3s.
#
# Run the setup task first (rerun it to rotate the development CA):
#   mise run keycloak:k8s:setup
#
# Then layer this file on top of values.yaml when deploying:
#   helm upgrade --install openshell . \
#     -f values.yaml -f ci/values-skaffold.yaml -f ci/values-keycloak.yaml
#
# Or add this file to skaffold.yaml valuesFiles for iterative dev.
#
# Issuer note: the setup task configures Keycloak with KC_HOSTNAME set to the
# in-cluster service hostname, so tokens always carry that hostname as `iss`
# regardless of how they were obtained (e.g. via a localhost port-forward).
# The gateway fetches JWKS over TLS from this URL inside the cluster. The setup
# task creates the Keycloak development CA ConfigMap referenced below.
#
# CLI token acquisition: keep a port-forward running while using openshell login:
#   kubectl -n keycloak port-forward svc/keycloak 9090:80

gatewayConfig:
  openshell.gateway.oidc:
    # Must match KC_HOSTNAME set by keycloak:k8s:setup (in-cluster service hostname).
    issuer: "https://keycloak.keycloak.svc.cluster.local:443/realms/openshell"
    # Must match the client ID in the imported realm (openshell-cli).
    audience: "openshell-cli"
    # Short TTL for dev so JWKS key rotation is picked up quickly.
    # Use 3600 (default) in production.
    jwks_ttl_secs: 60
    # Keycloak puts realm roles at realm_access.roles in the JWT.
    roles_claim: "realm_access.roles"
    # Leave both empty for authentication-only mode (any valid token is accepted).
    admin_role: "openshell-admin"
    user_role: "openshell-user"

# This is a Kubernetes ConfigMap mounted by the chart, not a gateway TOML
# field, so it remains a chart-owned resource reference.
server:
  oidc:
    caConfigMapName: "openshell-keycloak-ca"