moc-keycloak/main.tf at main · CCI-MOC/moc-keycloak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

locals {
  realm_id = "moc"
  openshift_oidc_clusters = {
    oac_prod_infra = {
      cluster_name           = "oac-prod-infra"
      openshift_redirect_uri = "https://oauth-openshift.apps.infra.oac.ocp.massopen.cloud/oauth2callback/mocsso"
      client_secret_name     = "cluster/oac-prod-infra/keycloak-oidc"
      keycloak_client_uuid   = "oac-prod-infra"
    }
    oac_prod_workload0 = {
      cluster_name           = "oac-prod-workload0"
      openshift_redirect_uri = "https://oauth-oac-prod-workload0.hcp.oac.massopen.cloud:443/oauth2callback/mocsso"
      client_secret_name     = "cluster/oac-prod-infra/hostedcluster/oac-prod-workload0/keycloak-oidc"
      keycloak_client_uuid   = "oac-prod-workload0"
    }
    oac_dev_workload0 = {
      cluster_name           = "oac-dev-workload0"
      openshift_redirect_uri = "https://oauth-oac-dev-workload0.hcp.oac.int.massopen.cloud:443/oauth2callback/mocsso"
      client_secret_name     = "cluster/oac-dev-infra/hostedcluster/oac-dev-workload0/keycloak-oidc"
      keycloak_client_uuid   = "oac-dev-workload0"
    }
  }
}

module "openshift_oidc" {
  for_each = local.openshift_oidc_clusters

  source                 = "./modules/openshift-oidc"
  cluster_name           = each.value.cluster_name
  openshift_redirect_uri = each.value.openshift_redirect_uri
  client_secret_name     = each.value.client_secret_name
  realm_id               = keycloak_realm.moc.id
  use_secrets_manager    = var.use_secrets_manager
  additional_scope_names = [keycloak_openid_client_scope.groups.name, keycloak_openid_client_scope.openid.name]
}