{"id":51175336,"url":"https://github.com/thunderbird/keycloak-customer-deploy","last_synced_at":"2026-06-27T03:05:27.181Z","repository":{"id":365344810,"uuid":"1267612804","full_name":"thunderbird/keycloak-customer-deploy","owner":"thunderbird","description":"Kustomize manifests for Thunderbird Pro Customer Auth (Keycloak realm tbpro) on EKS","archived":false,"fork":false,"pushed_at":"2026-06-16T23:27:58.000Z","size":24,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-17T01:15:42.713Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thunderbird.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-12T17:46:06.000Z","updated_at":"2026-06-12T17:46:14.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/thunderbird/keycloak-customer-deploy","commit_stats":null,"previous_names":["thunderbird/keycloak-customer-deploy"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/thunderbird/keycloak-customer-deploy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thunderbird%2Fkeycloak-customer-deploy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thunderbird%2Fkeycloak-customer-deploy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thunderbird%2Fkeycloak-customer-deploy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thunderbird%2Fkeycloak-customer-deploy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thunderbird","download_url":"https://codeload.github.com/thunderbird/keycloak-customer-deploy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thunderbird%2Fkeycloak-customer-deploy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34839936,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-27T02:00:06.362Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-27T03:05:22.995Z","updated_at":"2026-06-27T03:05:27.154Z","avatar_url":"https://github.com/thunderbird.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# keycloak-customer-deploy\n\nKustomize manifests for **Thunderbird Pro Customer Auth** — the Keycloak instance\nserving realm `tbpro` (`auth.tb.pro`) — deployed to the Thunderbird Pro EKS\nclusters via ArgoCD. Migration plan \u0026 target architecture:\n[`platform-infrastructure/docs/keycloak-customer-auth-migration.md`](https://github.com/thunderbird/platform-infrastructure/blob/main/docs/keycloak-customer-auth-migration.md).\nEpic: [platform-infrastructure#132](https://github.com/thunderbird/platform-infrastructure/issues/132).\n\n\u003e **Database is shared Neon, not RDS.** Source ECS and the EKS target use the same\n\u003e shared Neon Postgres DB, reached over PrivateLink. There is **no data migration** —\n\u003e the prod cutover is a traffic flip. Validation runs against isolated Neon branches\n\u003e (`mzla-tb-{dev,prod}`). The vestigial ACK-RDS machinery was removed\n\u003e ([platform-infrastructure#579](https://github.com/thunderbird/platform-infrastructure/issues/579)).\n\n## Layout\n\n```\nbases/\n  keycloak/   namespace, StatefulSet, services (incl. metrics), PDB,\n              db/admin ExternalSecrets, VMServiceScrape\noverlays/\n  tb-dev/     tailnet-only (Tailscale Ingress); Neon branch mzla-tb-dev; 2 replicas\n  tb-prod/    tailnet-only validation; Neon branch mzla-tb-prod; 2 replicas\n              (public Cloudflare tunnel + tailnet admin + 3 replicas are kept in the\n              overlay dir but unreferenced until the cutover, #142)\n```\n\nThe ArgoCD app-of-apps for each cluster lives in `platform-infrastructure`\n(`argocd/tb-{dev,prod}/apps/keycloak-customer.yaml`) and points at\n`overlays/\u003ccluster\u003e`. The cluster's Pulumi stack (`mzla-tb-{dev,prod}`, Phase 4e)\nprovides the Keycloak **Neon PrivateLink endpoint SG + pod SG + IRSA**; the pod SG\nis assigned to the pods via the overlay's `SecurityGroupPolicy`.\n\n## Build / validate\n\n```bash\n./util/kustomize-build-all.sh          # builds every overlay (CI gate)\nkustomize build overlays/tb-dev        # or a single overlay\n```\n\n## Exposure model\n\n- **Admin is never public.** It is reached over **Tailscale**, like the Staff SSO\n  Keycloak. Both dev and prod are tailnet-only today (whole service). At the prod\n  cutover (#142) tb-prod adds a public Cloudflare tunnel for the auth host, with the\n  admin console/REST kept on the tailnet (`KC_HOSTNAME_ADMIN`) and public `/admin`\n  denied at the edge (Cloudflare Access).\n- **Realm `tbpro` lives in the shared Neon DB** (validated via isolated Neon\n  branches) — there is no `--import-realm` and no data migration.\n\n## DB connectivity (Neon over PrivateLink)\n\nThe overlay's `keycloak/statefulset.yaml` sets `KC_DB_URL_HOST` to the env's Neon\nendpoint (the `mzla-tb-{dev,prod}` branch today) + `KC_DB_URL_PROPERTIES=?sslmode=require`.\nThe pods reach Neon over the manually-created Neon interface endpoints, gated by the\ndedicated `mzla-tb-{dev,prod}-keycloak-neondb-privatelink` endpoint SG; the pods carry\nthe dedicated pod SG via `keycloak/securitygrouppolicy.yaml`.\n\n## Placeholders / per-env values\n\n| Token / value | Source |\n|-------|--------|\n| `REPLACE_MZLA_ECR/keycloak-customer` (`kustomization.yaml` `images:`) | the per-account mzla ECR mirror (done, [platform-infrastructure#558](https://github.com/thunderbird/platform-infrastructure/pull/558)); each overlay sets `newName` + `newTag` |\n| `keycloak/securitygrouppolicy.yaml` `groupIds` | the cluster's eks-cluster-sg + `pulumi stack output keycloak_customer_pod_sg_id` (`mzla-tb-{dev,prod}`) |\n| `KC_DB_URL_HOST` (overlay `keycloak/statefulset.yaml`) | the env's Neon endpoint (branch today; live shared endpoint at cutover) |\n\nSecrets (AWS Secrets Manager, per account, eu-central-1) referenced by the\nExternalSecrets: `mzla/\u003cenv\u003e/keycloak-customer-db` and\n`mzla/\u003cenv\u003e/keycloak-customer-admin` (`{username, password}`).\n`mzla/shared-services/cloudflare-operator` already exists (read cross-account; used by the cutover Cloudflare resources).\n\n## Not yet included (cutover follow-ups, #142)\n\n- Public Cloudflare tunnel (`auth.tb.pro`) + tailnet admin ingress + 3 replicas (files present, unreferenced).\n- Public `/admin` deny for tb-prod (Cloudflare Access).\n- Repoint `KC_DB_URL_HOST` from the validation branch to the live shared Neon endpoint.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthunderbird%2Fkeycloak-customer-deploy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthunderbird%2Fkeycloak-customer-deploy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthunderbird%2Fkeycloak-customer-deploy/lists"}