Update Helm release rabbitmq to v16

bootstrap/keycloak-theme/Dockerfile

@@ -0,0 +1,3 @@
+FROM busybox
+
+COPY keycloak-themes/oceanbox /theme

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/resources/css/oceanbox.css

@@ -0,0 +1,109 @@
+/* Oceanbox Keycloak Login Theme
+ *
+ * Branding aligned with oceanbox.io:
+ *   Primary teal:    #0bb4aa
+ *   Dark teal:       #37746F
+ *   Deep blue:       #031275
+ *   Background:      #f9fafd
+ *   Text:            #101010
+ */
+
+:root {
+    --pf-v5-global--primary-color--100: #0bb4aa;
+    --pf-v5-global--primary-color--200: #099e95;
+    --pf-v5-global--link--Color: #0bb4aa;
+    --pf-v5-global--link--Color--hover: #031275;
+}
+
+.login-pf body {
+    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
+    background-size: cover;
+    height: 100%;
+}
+
+/* Login container layout */
+.pf-v5-c-login__container {
+    grid-template-columns: 34rem;
+    grid-template-areas: "header"
+                         "main";
+}
+
+/* Logo */
+div.kc-logo-text {
+    background-image: url('../img/oceanbox-logo-text.png');
+    height: 80px;
+    width: 360px;
+    background-repeat: no-repeat;
+    background-size: contain;
+    background-position: center;
+    margin: 0 auto;
+}
+
+div.kc-logo-text span {
+    display: none;
+}
+
+/* Header */
+#kc-header-wrapper {
+    font-size: 29px;
+    text-transform: uppercase;
+    letter-spacing: 3px;
+    line-height: 1.2em;
+    white-space: normal;
+    color: #37746F !important;
+    text-align: center;
+}
+
+/* Login card */
+.pf-v5-c-login__main {
+    border-radius: 8px;
+    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
+}
+
+/* Primary button */
+.pf-v5-c-button.pf-m-primary {
+    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
+    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
+    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
+    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
+    border-radius: 4px;
+}
+
+/* Links */
+.pf-v5-c-button.pf-m-link {
+    --pf-v5-c-button--m-link--Color: #0bb4aa;
+    --pf-v5-c-button--m-link--hover--Color: #031275;
+}
+
+a {
+    color: #0bb4aa;
+}
+
+a:hover {
+    color: #031275;
+}
+
+/* Form inputs */
+.pf-v5-c-form-control > input,
+.pf-v5-c-form-control > textarea {
+    border-radius: 4px;
+}
+
+#kc-recovery-codes-list {
+    columns: 2;
+}
+
+#certificate_subjectDN {
+    overflow-wrap: break-word;
+}
+
+hr {
+    margin-top: var(--pf-v5-global--spacer--sm);
+    margin-bottom: var(--pf-v5-global--spacer--md);
+}
+
+@media (min-width: 768px) {
+    div.pf-v5-c-login__main-header {
+        grid-template-columns: 70% 30%;
+    }
+}

bootstrap/keycloak-theme/keycloak-themes/oceanbox/login/theme.properties

@@ -0,0 +1,5 @@
+parent=keycloak.v2
+import=common/keycloak
+
+stylesCommon=vendor/patternfly-v5/patternfly.min.css vendor/patternfly-v5/patternfly-addons.css
+styles=css/styles.css css/oceanbox.css

helmfile.d/keycloak.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: {{ .Environment.Name }}-keycloak
   namespace: keycloak
   chart: bitnami/keycloak
-  version: 24.9.0
+  version: 25.2.0
   condition: keycloak.enabled
   values:
   - ../values/keycloak/values/values.yaml

helmfile.d/rabbitmq.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: {{ .Environment.Name }}-rabbitmq
   namespace: rabbitmq
   chart: bitnami/rabbitmq
-  version: 13.0.3
+  version: 16.0.14
   condition: rabbitmq.enabled
   values:
   - ../values/rabbitmq/values/values.yaml

npins/sources.json

@@ -1,23 +1,10 @@
 {
   "pins": {
-    "git-hooks": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "cachix",
-        "repo": "git-hooks.nix"
-      },
-      "branch": "master",
-      "submodules": false,
-      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
-      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
-    },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
-      "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
+      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
     },
     "treefmt-nix": {
       "type": "Git",
@@ -28,9 +15,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "337a4fe074be1042a35086f15481d763b8ddc0e7",
-      "url": "https://github.com/numtide/treefmt-nix/archive/337a4fe074be1042a35086f15481d763b8ddc0e7.tar.gz",
-      "hash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk="
+      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
+      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
     }
   },
   "version": 7

shell.nix

@@ -35,12 +35,15 @@ pkgs.mkShellNoCC {
     # pkgs.renovate
     # pkgs.graphviz
     # pkgs.hubble
-    # pkgs.dapr-cli
+    pkgs.cilium-cli
+    pkgs.dapr-cli
   ];
 
   # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "ekman";
+  ARGOCD_ENV_CLUSTER_NAME = "hel1";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
+  API_SERVER_IP = "localhost";
+  API_SERVER_PORT = "7445";
 
   # Alternative shells
   passthru = pkgs.lib.mapAttrs (name: value: pkgs.mkShellNoCC (value // { inherit name; })) {

values/argo/manifests/sys-project.yaml

@@ -94,6 +94,8 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: jobset-system
     server: https://kubernetes.default.svc
+  - namespace: dex
+    server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
@@ -140,3 +142,4 @@ spec:
   - https://operator.mariadb.com
   - https://ot-container-kit.github.io/helm-charts
   - https://twin.github.io/helm-charts
+  - https://charts.dexidp.io

values/gitea/values/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 image:
   registry: "docker.gitea.com"
   repository: gitea
-  tag: "1.25.4"
+  tag: "1.25.5"
 
 resources:
   requests:

values/keycloak/README.md

@@ -8,6 +8,7 @@ kubectl cp -n keycloak oceanbox-realm.json prod-keycloak-0:/tmp/backup/oceanbox-
 kubectl cp -n keycloak oceanbox-users-0.json prod-keycloak-0:/tmp/backup/oceanbox-users-0.json
 kc.sh -Djgroups.bind.port=7801 import --dir /tmp/backup
 ```
+
 ## Theme
 
-Our keycloak theme is inserted using the image provided [here](https://gitlab.com/oceanbox/keycloak-theme)
+The keycloak theme is maintained at [git.oceanbox.io/platform/keycloak-theme](https://git.oceanbox.io/platform/keycloak-theme) and is deployed via an init container using the `git.oceanbox.io/platform/keycloak-theme` image.

values/keycloak/manifests/keycloak.yaml

@@ -33,10 +33,8 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
     {{- if .Values.keycloak.autosync }}
     automated:
       prune: true
-      # selfHeal: false
     {{- end }}
 {{- end }}

values/keycloak/values/values-prod.yaml

@@ -1,26 +1,14 @@
 replicaCount: 2
 
-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
   adminPassword: en to tre fire
-  adminUser: admin
   existingSecret: ""
   managementPassword: ""
-  managementUser: manager
 
 postgresql:
   enabled: false
 
+resourcesPreset: "none"
 resources:
   limits:
     cpu: 750m
@@ -48,37 +36,7 @@ extraVolumes:
   name: theme
 
 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
   hostname: auth.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: keycloak.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
 
 keycloakConfigCli:
   enabled: false
@@ -93,8 +51,8 @@ keycloakConfigCli:
 
 initContainers: |
   - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
+    image: git.oceanbox.io/platform/keycloak-theme:latest
+    imagePullPolicy: IfNotPresent
     command:
       - sh
     args:

values/keycloak/values/values-staging.yaml

@@ -1,22 +1,7 @@
 replicaCount: 1
 
-# NOTE(mrtz): Hack for working with bitnami legacy registry
-global:
-  security:
-    allowInsecureImages: true
-image:
-    repository: bitnamilegacy/keycloak
-
-production: true
-
-proxy: edge
-
 auth:
   adminPassword: en to tre fire
-  adminUser: admin
-  existingSecret: ""
-  managementPassword: ""
-  managementUser: manager
 
 postgresql:
   enabled: true
@@ -24,58 +9,5 @@ postgresql:
     postgresPassword: "avatar mustiness economic"
     password: "punctured abstain facility"
 
-extraVolumeMounts:
-- mountPath: /opt/bitnami/keycloak/themes/oceanbox
-  name: theme
-
-extraVolumes:
-- emptyDir: {}
-  name: theme
-
 ingress:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  enabled: true
   hostname: auth.srv.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-adminIngress:
-  enabled: false
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hostname: auth.adm.oceanbox.io
-  ingressClassName: nginx
-  path: /
-  pathType: ImplementationSpecific
-  selfSigned: false
-  servicePort: http
-  tls: true
-
-initContainers: |
-  - name: keycloak-theme-provider
-    image: docker.io/juselius/oceanbox-theme:1.2
-    imagePullPolicy: Always
-    command:
-      - sh
-    args:
-      - -c
-      - |
-        echo "Copying theme..."
-        cp -R /theme/* /keycloak/themes/oceanbox
-    volumeMounts:
-      - name: theme
-        mountPath: /keycloak/themes/oceanbox

values/keycloak/values/values.yaml

@@ -0,0 +1,29 @@
+# NOTE(mrtz): Hack for working with bitnami legacy registry
+global:
+  security:
+    allowInsecureImages: true
+image:
+    repository: bitnamilegacy/keycloak
+
+production: true
+
+proxyHeaders: xforwarded
+
+auth:
+  adminUser: admin
+  managementUser: manager
+
+ingress:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  enabled: true
+  ingressClassName: nginx
+  path: /
+  pathType: ImplementationSpecific
+  selfSigned: false
+  servicePort: http
+  tls: true

values/system/hel1/network/allow-microsoft-oidc-login.yaml

@@ -9,4 +9,5 @@ spec:
   - toFQDNs:
     - matchName: login.microsoftonline.com
     - matchPattern: '*.microsoftonline.com'
+    - matchName: graph.microsoft.com
 {{- end }}

values/system/oceanbox/network/allow-microsoft-oidc-login.yaml

@@ -9,4 +9,5 @@ spec:
   - toFQDNs:
     - matchName: login.microsoftonline.com
     - matchPattern: '*.microsoftonline.com'
+    - matchName: graph.microsoft.com
 {{- end }}