From 35373120453000368c07e0ed20389215aba08bdd Mon Sep 17 00:00:00 2001 From: Konstantin Lebedev <9497591+kmlebedev@users.noreply.github.com> Date: Fri, 29 May 2026 01:39:32 +0500 Subject: [PATCH] [docker] add make test_keycloak_s3 for local develop and debug (#9719) * add make test_keylock_s3 for local develop and debug * fix typos * add condition oidc:azp * docker: reuse test/s3/iam realm and iam config for keycloak dev compose Point the keycloak dev compose at the existing test/s3/iam configs instead of a parallel realm/port/key/role set. Adds one declarative realm import (seaweedfs-test-realm.json) as the single realm source and drops the duplicated iam.json/s3.json. --------- Co-authored-by: Chris Lu --- docker/Makefile | 3 + docker/compose/test-keycloak-s3.yml | 46 +++++++++++ test/s3/iam/seaweedfs-test-realm.json | 107 ++++++++++++++++++++++++++ 3 files changed, 156 insertions(+) create mode 100644 docker/compose/test-keycloak-s3.yml create mode 100644 test/s3/iam/seaweedfs-test-realm.json diff --git a/docker/Makefile b/docker/Makefile index 31ccf9da1..d803c5a40 100644 --- a/docker/Makefile +++ b/docker/Makefile @@ -127,6 +127,9 @@ test_tarantool: tags = tarantool test_tarantool: build_tarantool_dev_env build docker compose -f compose/test-tarantool-filer.yml -p seaweedfs up +test_keycloak_s3: build + docker compose -f compose/test-keycloak-s3.yml -p seaweedfs up + clean: rm ./weed diff --git a/docker/compose/test-keycloak-s3.yml b/docker/compose/test-keycloak-s3.yml new file mode 100644 index 000000000..ec4d1356a --- /dev/null +++ b/docker/compose/test-keycloak-s3.yml @@ -0,0 +1,46 @@ +services: + keycloak: + image: quay.io/keycloak/keycloak:26.0.7 + command: ["start-dev", "--import-realm"] + environment: + KC_BOOTSTRAP_ADMIN_USERNAME: admin + KC_BOOTSTRAP_ADMIN_PASSWORD: admin + KC_HTTP_ENABLED: "true" + KC_HOSTNAME: "http://keycloak:8080" + KC_HOSTNAME_STRICT: "false" + ports: + - "8080:8080" + volumes: + - ../../test/s3/iam/seaweedfs-test-realm.json:/opt/keycloak/data/import/seaweedfs-test-realm.json:ro + healthcheck: + test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/8080"] + interval: 10s + timeout: 5s + retries: 5 + start_period: 60s + + s3: + image: chrislusf/seaweedfs:local + command: + - -v=9 + - server + - -ip=s3 + - -filer + - -master.volumeSizeLimitMB=16 + - -volume + - -volume.max=0 + - -volume.preStopSeconds=1 + - -s3 + - -s3.port=8333 + - -s3.config=/etc/seaweedfs/s3_config.json + - -s3.iam.config=/etc/seaweedfs/iam_config.json + environment: + WEED_MASTER_VOLUME_GROWTH_COPY_OTHER: 1 + volumes: + - ../../test/s3/iam/test_config.json:/etc/seaweedfs/s3_config.json:ro + - ../../test/s3/iam/iam_config_docker.json:/etc/seaweedfs/iam_config.json:ro + ports: + - "8333:8333" + depends_on: + keycloak: + condition: service_healthy diff --git a/test/s3/iam/seaweedfs-test-realm.json b/test/s3/iam/seaweedfs-test-realm.json new file mode 100644 index 000000000..f8ec6476d --- /dev/null +++ b/test/s3/iam/seaweedfs-test-realm.json @@ -0,0 +1,107 @@ +{ + "realm": "seaweedfs-test", + "enabled": true, + "roles": { + "realm": [ + { "name": "s3-admin" }, + { "name": "s3-read-only" }, + { "name": "s3-write-only" }, + { "name": "s3-read-write" } + ] + }, + "clients": [ + { + "clientId": "seaweedfs-s3", + "enabled": true, + "secret": "seaweedfs-s3-secret", + "publicClient": false, + "serviceAccountsEnabled": true, + "standardFlowEnabled": true, + "directAccessGrantsEnabled": true, + "fullScopeAllowed": true, + "redirectUris": ["*"], + "webOrigins": ["*"], + "protocol": "openid-connect", + "protocolMappers": [ + { + "name": "realm-roles", + "protocol": "openid-connect", + "protocolMapper": "oidc-usermodel-realm-role-mapper", + "config": { + "claim.name": "roles", + "jsonType.label": "String", + "multivalued": "true", + "usermodel.realmRoleMapping.rolePrefix": "", + "access.token.claim": "true", + "id.token.claim": "true", + "userinfo.token.claim": "true" + } + }, + { + "name": "audience-mapper", + "protocol": "openid-connect", + "protocolMapper": "oidc-audience-mapper", + "config": { + "included.client.audience": "seaweedfs-s3", + "id.token.claim": "false", + "access.token.claim": "true" + } + } + ] + } + ], + "users": [ + { + "username": "admin-user", + "enabled": true, + "email": "admin-user@test.com", + "firstName": "Test", + "lastName": "User", + "emailVerified": true, + "requiredActions": [], + "realmRoles": ["s3-admin"], + "credentials": [ + { "type": "password", "value": "adminuser123", "temporary": false } + ] + }, + { + "username": "read-user", + "enabled": true, + "email": "read-user@test.com", + "firstName": "Test", + "lastName": "User", + "emailVerified": true, + "requiredActions": [], + "realmRoles": ["s3-read-only"], + "credentials": [ + { "type": "password", "value": "readuser123", "temporary": false } + ] + }, + { + "username": "write-user", + "enabled": true, + "email": "write-user@test.com", + "firstName": "Test", + "lastName": "User", + "emailVerified": true, + "requiredActions": [], + "realmRoles": ["s3-read-write"], + "credentials": [ + { "type": "password", "value": "writeuser123", "temporary": false } + ] + }, + { + "username": "write-only-user", + "enabled": true, + "email": "write-only-user@test.com", + "firstName": "Test", + "lastName": "User", + "emailVerified": true, + "requiredActions": [], + "realmRoles": ["s3-write-only"], + "credentials": [ + { "type": "password", "value": "writeonlyuser123", "temporary": false } + ] + } + ] +}