values.yaml

global:
  localClusterDomain: apps.example.com
  secretStore:
    kind: ClusterSecretStore
    name: vault-backend
keycloak:
  adminUser:
    enabled: true
    username: admin
    # Keycloak admin password (infra)
    passwordVaultKey: secret/data/hub/infra/keycloak/keycloak
    secretName: keycloak-admin-user
  defaultConfig: true
  defaultRealm:
    clients:
      - clientId: qtodo-app
        enabled: true
        name: qtodo
        protocol: openid-connect
        publicClient: false
        clientAuthenticatorType: federated-jwt
        serviceAccountsEnabled: true
        redirectUris:
          - "*"
        standardFlowEnabled: true
        directAccessGrantsEnabled: false
        webOrigins:
          - +
        fullScopeAllowed: true
        attributes:
          jwt.credential.issuer: spiffe
          # Auto-generated by template: spiffe://<localClusterDomain>/ns/qtodo/sa/qtodo
          jwt.credential.sub: ""
          post.logout.redirect.uris: "+"
        defaultClientScopes:
          - web-origins
          - roles
          - profile
          - basic
          - email
        optionalClientScopes:
          - offline_access
      - clientId: trusted-artifact-signer
        enabled: true
        name: Red Hat Trusted Artifact Signer Client
        protocol: openid-connect
        publicClient: true
        redirectUris:
          - "*"
          - "urn:ietf:wg:oauth:2.0:oob"
          - "http://localhost:*/auth/callback"
        directAccessGrantsEnabled: true
        standardFlowEnabled: true
        implicitFlowEnabled: false
        webOrigins:
          - +
        attributes:
          oauth2.device.authorization.grant.enabled: "true"
        protocolMappers:
          - name: audience-mapper
            protocol: openid-connect
            protocolMapper: oidc-audience-mapper
            config:
              included.client.audience: trusted-artifact-signer
              access.token.claim: "true"
              id.token.claim: "false"
          - name: email-mapper
            protocol: openid-connect
            protocolMapper: oidc-hardcoded-claim-mapper
            consentRequired: false
            config:
              claim.name: email_verified
              claim.value: "true"
              jsonType.label: boolean
              access.token.claim: "true"
              id.token.claim: "true"
              userinfo.token.claim: "false"
      # ACS Central OIDC Client
      - clientId: acs-central
        enabled: true
        name: Red Hat Advanced Cluster Security Central
        protocol: openid-connect
        publicClient: false
        secret: ${ACS_CLIENT_SECRET}
        redirectUris:
          - "*"
        directAccessGrantsEnabled: true
        standardFlowEnabled: true
        implicitFlowEnabled: false
        webOrigins:
          - "*"
        fullScopeAllowed: true
        defaultClientScopes:
          - openid
          - basic
          - email
          - profile
          - roles
          - web-origins
        optionalClientScopes:
          - address
          - phone
          - offline_access
        protocolMappers:
          - name: groups
            protocol: openid-connect
            protocolMapper: oidc-group-membership-mapper
            consentRequired: false
            config:
              full.path: "false"
              id.token.claim: "true"
              access.token.claim: "true"
              claim.name: groups
              userinfo.token.claim: "true"
          - name: roles
            protocol: openid-connect
            protocolMapper: oidc-usermodel-realm-role-mapper
            consentRequired: false
            config:
              multivalued: "true"
              userinfo.token.claim: "true"
              id.token.claim: "true"
              access.token.claim: "true"
              claim.name: roles
              jsonType.label: String
      # RHTPA CLI Client - matches Trustify 'cli' client configuration
      # Reference: https://github.com/guacsec/trustify-helm-charts/blob/main/charts/trustify-infrastructure/templates/keycloak/010-ConfigMap.yaml
      - clientId: rhtpa-cli
        enabled: true
        name: RHTPA CLI Client
        protocol: openid-connect
        publicClient: false
        secret: ${RHTPA_CLI_SECRET}
        directAccessGrantsEnabled: false
        standardFlowEnabled: false
        implicitFlowEnabled: false
        serviceAccountsEnabled: true
        fullScopeAllowed: true
        defaultClientScopes:
          - basic
          - email
          - profile
          - roles
          - web-origins
          - create:document
          - read:document
          - update:document
          - delete:document
        optionalClientScopes:
          - address
          - microprofile-jwt
          - offline_access
          - phone
        attributes:
          access.token.lifespan: "300"
          post.logout.redirect.uris: "+"
      # RHTPA Frontend Client - matches Trustify 'frontend' client configuration
      # Reference: https://github.com/guacsec/trustify-helm-charts/blob/main/charts/trustify-infrastructure/templates/keycloak/010-ConfigMap.yaml
      - clientId: rhtpa-frontend
        enabled: true
        name: RHTPA Frontend Client
        protocol: openid-connect
        publicClient: true
        redirectUris:
          - "*"
        directAccessGrantsEnabled: false
        standardFlowEnabled: true
        implicitFlowEnabled: true
        serviceAccountsEnabled: false
        webOrigins:
          - "*"
        fullScopeAllowed: true
        defaultClientScopes:
          - basic
          - email
          - profile
          - roles
          - web-origins
          - create:document
          - read:document
          - update:document
          - delete:document
        optionalClientScopes:
          - address
          - microprofile-jwt
          - offline_access
          - phone
        attributes:
          access.token.lifespan: "300"
          post.logout.redirect.uris: "+"
    displayName: ZTVP Realm
    enabled: true
    realm: ztvp
    registrationAllowed: false
    # Client scopes
    # Note: We must define 'basic' scope with 'sub' mapper for OIDC compliance
    # The 'sub' claim is required by RHTPA for user identification
    clientScopes:
      # OpenID scope - mandatory OIDC scope (required by ACS and other OIDC clients)
      - name: openid
        description: OpenID Connect built-in scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "false"
        protocolMappers:
          - name: sub
            protocol: openid-connect
            protocolMapper: oidc-sub-mapper
            consentRequired: false
            config:
              introspection.token.claim: "true"
              access.token.claim: "true"
              id.token.claim: "true"
      # Basic scope - required for 'sub' claim in tokens
      # Standard OIDC scopes required by Trustify/RHTPA
      # Reference: https://github.com/mrrajan/trustify/blob/doc_rhbk_operator/docs/book/modules/admin/pages/infrastructure.adoc
      - name: basic
        description: OpenID Connect basic scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "false"
          display.on.consent.screen: "false"
        protocolMappers:
          - name: sub
            protocol: openid-connect
            protocolMapper: oidc-sub-mapper
            consentRequired: false
            config:
              introspection.token.claim: "true"
              access.token.claim: "true"
      - name: email
        description: OpenID Connect email scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "true"
          consent.screen.text: "${emailScopeConsentText}"
        protocolMappers:
          - name: email
            protocol: openid-connect
            protocolMapper: oidc-usermodel-attribute-mapper
            consentRequired: false
            config:
              userinfo.token.claim: "true"
              user.attribute: email
              id.token.claim: "true"
              access.token.claim: "true"
              claim.name: email
              jsonType.label: String
          - name: email verified
            protocol: openid-connect
            protocolMapper: oidc-usermodel-attribute-mapper
            consentRequired: false
            config:
              userinfo.token.claim: "true"
              user.attribute: emailVerified
              id.token.claim: "true"
              access.token.claim: "true"
              claim.name: email_verified
              jsonType.label: boolean
      - name: profile
        description: OpenID Connect profile scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "true"
          consent.screen.text: "${profileScopeConsentText}"
        protocolMappers:
          - name: username
            protocol: openid-connect
            protocolMapper: oidc-usermodel-attribute-mapper
            consentRequired: false
            config:
              userinfo.token.claim: "true"
              user.attribute: username
              id.token.claim: "true"
              access.token.claim: "true"
              claim.name: preferred_username
              jsonType.label: String
          - name: full name
            protocol: openid-connect
            protocolMapper: oidc-full-name-mapper
            consentRequired: false
            config:
              id.token.claim: "true"
              access.token.claim: "true"
              userinfo.token.claim: "true"
      - name: roles
        description: OpenID Connect roles scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "false"
          display.on.consent.screen: "true"
          consent.screen.text: "${rolesScopeConsentText}"
        protocolMappers:
          - name: realm roles
            protocol: openid-connect
            protocolMapper: oidc-usermodel-realm-role-mapper
            consentRequired: false
            config:
              multivalued: "true"
              user.attribute: foo
              access.token.claim: "true"
              claim.name: realm_access.roles
              jsonType.label: String
          - name: audience resolve
            protocol: openid-connect
            protocolMapper: oidc-audience-resolve-mapper
            consentRequired: false
      - name: web-origins
        description: OpenID Connect web origins scope
        protocol: openid-connect
        attributes:
          include.in.token.scope: "false"
          display.on.consent.screen: "false"
        protocolMappers:
          - name: allowed web origins
            protocol: openid-connect
            protocolMapper: oidc-allowed-origins-mapper
            consentRequired: false
            config:
              access.token.claim: "true"
      # RHTPA document permission scopes
      - name: create:document
        description: Permission to create documents
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "false"
      - name: read:document
        description: Permission to read documents
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "false"
      - name: update:document
        description: Permission to update documents
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "false"
      - name: delete:document
        description: Permission to delete documents
        protocol: openid-connect
        attributes:
          include.in.token.scope: "true"
          display.on.consent.screen: "false"
    # Set default client scopes for the realm (applied to all new clients)
    defaultDefaultClientScopes:
      - openid
      - basic
      - email
      - profile
      - roles
      - web-origins
    roles:
      realm:
        - description: QTodo App Administrator
          name: qtodo-admin
        - description: Read-only access
          name: viewer
        - description: RHTPA SBOM Creator
          name: create:sbom
        - description: RHTPA Document Creator
          name: create:document
        - description: ACS Administrator
          name: acs-admin
    users:
      - createdTimestamp: 1
        credentials:
          - temporary: true
            type: password
            value: ${QTODO_ADMIN_PASSWORD}
        email: qtodo-admin@example.com
        emailVerified: true
        enabled: true
        firstName: QTodo
        lastName: Admin
        realmRoles:
          - qtodo-admin
        requiredActions:
          - UPDATE_PASSWORD
        username: qtodo-admin
      - createdTimestamp: 1
        credentials:
          - temporary: true
            type: password
            value: ${QTODO_USER1_PASSWORD}
        email: qtodo-user1@example.com
        emailVerified: true
        enabled: true
        firstName: QTodo
        lastName: User-1
        realmRoles:
          - viewer
        requiredActions:
          - UPDATE_PASSWORD
        username: qtodo-user1
      - createdTimestamp: 1
        credentials:
          - temporary: false
            type: password
            value: ${RHTAS_USER_PASSWORD}
        email: rhtas-user@example.com
        emailVerified: true
        enabled: true
        firstName: RHTAS
        lastName: Signer
        realmRoles:
          - viewer
        username: rhtas-user
      - createdTimestamp: 1
        credentials:
          - temporary: false
            type: password
            value: ${RHTPA_USER_PASSWORD}
        email: rhtpa-user@example.com
        emailVerified: true
        enabled: true
        firstName: RHTPA
        lastName: User
        realmRoles:
          - viewer
          - create:sbom
          - create:document
        username: rhtpa-user
      - createdTimestamp: 1
        credentials:
          - temporary: false
            type: password
            value: ${ACS_ADMIN_PASSWORD}
        email: acs-admin@example.com
        emailVerified: true
        enabled: true
        firstName: ACS
        lastName: Administrator
        realmRoles:
          - acs-admin
          - offline_access
        username: acs-admin
  ingress:
    enabled: true
    service: keycloak-service-trusted
    termination: reencrypt
    hostname: ""
  name: keycloak
  postgresqlDb:
    database: keycloak
    # Keycloak DB password path (infra)
    passwordVaultKey: secret/data/hub/infra/keycloak/keycloak
    secretName: postgresql-db
    username: keycloak
  realms: []
  tls:
    secret: keycloak-tls
    serviceServing: true
  users:
    # User credentials path (infra)
    passwordVaultKey: secret/data/hub/infra/users/keycloak-users
    secretName: keycloak-users
  # OIDC client secrets for realm configuration
  oidcSecrets:
    # QTodo OIDC client secret — disabled when using federated-jwt (client assertion)
    qtodo:
      enabled: false
      vaultPath: secret/data/apps/qtodo/qtodo-oidc-client
    # RHTPA CLI OIDC client secret (infra)
    rhtpaCli:
      vaultPath: secret/data/hub/infra/rhtpa/rhtpa-oidc-cli
    # ACS Central OIDC client secret (infra)
    acsClient:
      vaultPath: secret/data/hub/infra/acs/acs-central
  # SPIFFE Identity Provider for Federated Client Authentication
  # Requires RHBK 26.4+ with Technology Preview features: spiffe + client-auth-federated
  # (automatically enabled in keycloak.yaml when this is enabled)
  #
  # Uses an OIDC provider type (not Keycloak's native SPIFFE provider) because the
  # ZTWIM operator forces SpireServer.jwtIssuer to be an HTTPS URL, so JWT SVIDs
  # contain iss: "https://spire-spiffe-oidc-discovery-provider.<domain>".
  # Keycloak's native SPIFFE IdP rejects this (expects spiffe:// URI).
  # The OIDC provider matches the HTTPS issuer, enabling Keycloak's federated-jwt
  # client authenticator to resolve clients by iss+sub without requiring client_id.
  #
  # Reference: https://www.keycloak.org/2026/01/federated-client-authentication
  spiffeIdentityProvider:
    enabled: true
    config:
      alias: spiffe
      displayName: SPIFFE Workload Identity
      providerId: oidc
      enabled: true
      hideOnLogin: true
      config:
        # SPIRE OIDC Discovery Provider issuer URL (auto-generated if empty)
        issuer: ""
        # Required by Keycloak OIDC IdP but unused for federated client auth
        authorizationUrl: ""
        tokenUrl: ""
        # SPIRE OIDC Discovery Provider JWKS URL (auto-generated if empty)
        jwksUrl: ""
        clientId: keycloak
        clientSecret: unused
        useJwksUrl: "true"
        validateSignature: "true"
        supportsClientAssertions: "true"
        supportsClientAssertionReuse: "true"
        syncMode: LEGACY