{"id":15131453,"url":"https://github.com/cynicdog/cloud-native-spring-jib-k8s-action","last_synced_at":"2026-02-07T05:32:27.728Z","repository":{"id":256294645,"uuid":"854906579","full_name":"CynicDog/cloud-native-spring-jib-k8s-action","owner":"CynicDog","description":"Hands-on template project for cloud-native Spring application development using Jib and GitHub Actions","archived":false,"fork":false,"pushed_at":"2024-10-03T01:47:05.000Z","size":18626,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-05T21:13:18.834Z","etag":null,"topics":["spring"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CynicDog.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-09-10T01:02:21.000Z","updated_at":"2025-02-18T01:52:00.000Z","dependencies_parsed_at":"2024-10-31T12:37:52.212Z","dependency_job_id":null,"html_url":"https://github.com/CynicDog/cloud-native-spring-jib-k8s-action","commit_stats":null,"previous_names":["cynicdog/cloud-native-spring-jib-k8s-action","cynicdog/multi-gradle-projects"],"tags_count":0,"template":true,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CynicDog%2Fcloud-native-spring-jib-k8s-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CynicDog%2Fcloud-native-spring-jib-k8s-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CynicDog%2Fcloud-native-spring-jib-k8s-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CynicDog%2Fcloud-native-spring-jib-k8s-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CynicDog","download_url":"https://codeload.github.com/CynicDog/cloud-native-spring-jib-k8s-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247399884,"owners_count":20932880,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["spring"],"created_at":"2024-09-26T03:42:13.099Z","updated_at":"2026-02-07T05:32:27.701Z","avatar_url":"https://github.com/CynicDog.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n### Index\n\n1. [Version Table](#version-table)\n2. [Minikube Deployment](#minikube-deployment)\n     1. [Prerequisites](#1-prerequisites)\n     1. [Pull the Docker Image](#2-pull-the-docker-image)\n     2. [Start Minikube](#3-start-minikube)\n     3. [Load the Image onto Minikube (Optional)](#4-load-the-image-onto-minikube-optional)\n        - [For Linux/macOS](#41-for-linuxmacos)\n        - [For Windows](#42-for-windows)\n     4. [Apply the Manifest Files](#5-apply-the-manifest-files)\n     5. [Access the Application via Ingress](#6-access-the-application-via-ingress)\n3. [Defining a Security Realm on Keycloak](#defining-a-security-realm-on-keycloak)\n   - [1. Execute a bash session in the running container](#1-execute-a-bash-session-in-the-running-container)\n   - [2. Navigate to the CLI script directory and authenticate the session](#2-navigate-to-the-cli-script-directory-and-authenticate-the-session)\n   - [3. Create a dedicated realm for a service](#3-create-a-dedicated-realm-for-a-service)\n   - [4. Create roles](#4-create-roles)\n   - [5. Add users and credentials](#5-add-users-and-credentials)\n   - [6. Register Edge Service as OAuth2 Client in the realm](#6-register-edge-service-as-oauth2-client-in-the-realm)\n     - [6.1. Local Execution](#61-local-execution)\n     - [6.2. Containerized Execution (Docker Compose)](#62-containerized-execution-docker-compose)\n     - [6.3. Kubernetes Execution](#63-kubernetes-execution)\n4. [Create GitHub Identity Provider (GitHub Apps)](#create-github-identity-provider-github-apps)\n   - [Create a GitHub App with Email Read Permission](#create-a-github-app-with-email-read-permission)\n   - [Register GitHub App Client ID and Secret as Keycloak Client information](#register-github-app-client-id-and-secret-as-keycloak-client-information)\n\n# Version Table\n\n|             | Version       |\n|-------------|---------------|\n| JDK         | 20 (Temurin)  |\n| Spring Boot | 3.0.0         |\n| Gradle      | 8.10          |\n| Jib         | 3.4.3         |\n| Minikube    | 1.32.0        |\n\n# Minikube Deployment \n\nDeploy a Spring Boot application using Minikube on macOS and Windows with Ingress and manifest files.\n\n---\n\n## 1. Prerequisites\n\n- Docker\n- Minikube\n- kubectl\n- HTTPie or curl\n\n---\n\n## 2. Pull the Docker Image\n```bash\ndocker pull ghcr.io/cynicdog/cloud-native-spring-jib-k8s-action/catalog-service:latest\n```\n\u003e 1. Make sure to clear the previous credentials on `ghcr.io` in your local Docker context by running `docker logout ghcr.io`.\n\u003e 2. You may specify the build platform of the image by adding `--platform` tag with the value `linux/amd64` or `linux/arm64`.\n\n## 3. Start Minikube\n```bash\nminikube start --cpus 2 --memory 4g --driver docker\n```\n\u003e Assign compute resources at your need. \n\n## 4. Load the Image onto Minikube (Optional) \n\u003e You may skip this step if services are to be deployed declaratively using manifest files.\n\n### 4.1. For Linux/macOS:\n4.1.1. Set Docker to use Minikube’s environment:\n```bash\neval $(minikube docker-env)\n```\n\n4.1.2. Load the image into Minikube:\n```bash\nminikube image load cynicdog/catalog-service:latest\n```\n\n### 4.2. For Windows:\n4.2.1. Save the image as `.tar`:\n```bash\ndocker image save -o catalog-service-image.tar cynicdog/catalog-service:latest\n```\n\n4.2.2. Load the image into Minikube:\n```bash\nminikube image load catalog-service-image.tar\n```\n\n## 5. Apply the Manifest Files\n\n5.1. Enable Ingress on Minikube (if not done already):\n```bash\nminikube addons enable ingress\n```\n\n5.2. Apply the Kubernetes deployment and service manifest:\n```bash\nkubectl apply -f ./manifest/\n```\n\n## 6. Access the Application via Ingress\n\nOnce the Ingress is applied, you can retrieve the Minikube IP:\n```bash\nminikube ip\n```\n\nThen, expose the cluster to the local environment:\n```bash\nminikube tunnel\n```\n\n# Defining a security realm on Keycloak \n\n#### 1. Execute a bash session in the running container: \n```\nkubectl exec -it \u003cPOD-name\u003e -- /bin/bash\n```\n\n#### 2. Navigate to the CLI script directory and authenticate the session: \n```\ncd /opt/keycloak/bin\n./kcadm.sh config credentials \\\n    --server http://localhost:8080 \\\n    --realm master \\\n    --user {USER_NAME} \\\n    --password {PASSWORD}\n```\n\n#### 3. Create a dedicated realm for a service:\n```\n./kcadm.sh create realms -s realm={REALM_NAME} -s enabled=true\n```\n\n#### 4. Create roles: \n```\n$ ./kcadm.sh create roles -r {REALM_NAME} -s name={ROLE_NAME}\n```\n\n#### 5. Add users and credentials:\n```\n./kcadm.sh create users -r {REALM_NAME} \\\n    -s username={USERNAME} \\\n    -s firstName={FIRST_NAME} \\\n    -s lastName={LAST_NAME} \\\n    -s enabled=true\n \n./kcadm.sh add-roles -r {REALM_NAME} \\\n    --uusername {USERNAME} \\\n    --rolename {ROLE_NAME_1} \\\n    --rolename {ROLE_NAME_2}\n    \n./kcadm.sh set-password -r {REALM_NAME} \\\n   --username {USERNAME} \\\n   --new-password {PASSWORD}\n```\n\n### 6. Register Edge Service as OAuth2 Client in the realm \nMake sure you properly set the redirect URIs based on execution context. \n\n#### 6.1. Local Execution \n```\n    ./opt/keycloak/bin/kcadm.sh create clients -r {REALM_NAME} \\\n    -s clientId={CLIENT_SERVICE_NAME} \\\n    -s enabled=true \\\n    -s publicClient=false \\\n    -s secret={SOME_SECRET} \\\n    -s 'redirectUris=[\"http://localhost:9000\", \"http://localhost:9000/login/oauth2/code/*\"]'\n```\n\n#### 6.2. Containerized Execution (Docker Compose)\n```\n./opt/keycloak/bin/kcadm.sh create clients -r {REALM_NAME} \\\n    -s clientId={CLIENT_SERVICE_NAME} \\\n    -s enabled=true \\\n    -s publicClient=false \\\n    -s secret={SOME_SECRET} \\\n    -s 'redirectUris=[\"http://edge-service:9000\", \"http://edge-service:9000/login/oauth2/code/*\"]'\n```\n\n#### 6.3. Kubernetes Execution \n\nFirst, start the Minikube tunnel to make both Keycloak and the edge-service accessible. \n\n```\nminikube addons enable ingress \n\nkubectl apply -f ingress-bff.yml \nkubectl apply -f ingress-keycloak.yml \n\nminikube tunnel \n```\n\nNext, we need to modify the local DNS configuration. In Kubernetes, services are discovered by their names (such as edge-service and polar-keycloak). This works well for internal communications within the Kubernetes cluster.\n\nHowever, the Keycloak OAuth2 authentication flow requires requests with a URI that is exposed to the browser outside the cluster. Therefore, we need to configure local DNS so that the hostname resolves to the cluster IP address, which is accessible through the ingress interface we just created.\n\nOn terminal, run: \n```\necho \"\u003c127.0.0.1 | ip-address\u003e keycloak\" | sudo tee -a /etc/hosts\n```\n\nIf window, run as an administrator:\n```\nAdd-Content C:\\Windows\\System32\\drivers\\etc\\hosts \"127.0.0.1 keycloak\"\n```\n\nNow with the correct redirect URIs, let's bind the `edge-service` client to KeyCloak.  \n```\n./opt/keycloak/bin/kcadm.sh create clients -r {REALM_NAME} \\\n    -s clientId={CLIENT_SERVICE_NAME} \\\n    -s enabled=true \\\n    -s publicClient=false \\\n    -s secret={SOME_SECRET} \\\n    -s 'redirectUris=[\"http://127.0.0.1\", \"http://127.0.0.1/login/oauth2/code/*\"]'\n```\n\u003e Ensure the IP address (127.0.0.1) matches the Minikube tunnel gateway (in linux, you can retrieve the specific IP by running `minikube ip`)`.\n\n# Create GitHub Identity Provider (GitHub Apps) \n\n#### Create a GitHub App with Email Read Permission \n\n\u003cdetails\u003e\n  \u003csummary\u003eRegister Callback URL\u003c/summary\u003e\n  \u003cimg src=\"https://github.com/user-attachments/assets/903abd67-2e19-4035-9266-9183c63a8247\"\u003e\u003c/img\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003eAdd Read-Access Scope on Email\u003c/summary\u003e\n  \u003cimg src=\"https://github.com/user-attachments/assets/6a1e10c1-79d0-4928-8f33-b244e3505034\"\u003e\u003c/img\u003e\n\u003c/details\u003e\n\n#### Register GitHub App Client ID and Secret as Keyclock Client information \n\u003cdetails\u003e\n  \u003csummary\u003eRetrieve Client Credentials\u003c/summary\u003e\n  \u003cimg src=\"https://github.com/user-attachments/assets/6a1e10c1-79d0-4928-8f33-b244e3505034\"\u003e\u003c/img\u003e\n\u003c/details\u003e\n\nWith client credentials above, run the following command on your KeyCloak admin agent:  \n```\n/opt/keycloak/bin/kcadm.sh create identity-provider/instances \\\n\t-r {REALM_NAME} \\\n\t-s alias=github \\\n\t-s providerId=github \\\n\t-s enabled=true  \\\n\t-s 'config.useJwksUrl=\"true\"' \\\n\t-s config.clientId={CLIENT_ID} \\\n\t-s config.clientSecret={CLIENT_SECRET}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcynicdog%2Fcloud-native-spring-jib-k8s-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcynicdog%2Fcloud-native-spring-jib-k8s-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcynicdog%2Fcloud-native-spring-jib-k8s-action/lists"}