mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-19 13:46:58 +00:00
chrislu
299c86f002
- Add Docker Compose setup with Keycloak OIDC provider - Configure test realm with users, roles, and S3 client - Implement automatic detection between Keycloak and mock OIDC modes - Add comprehensive Keycloak integration tests for authentication and authorization - Support real JWT token validation with production-like OIDC flow - Add Docker-specific IAM configuration for containerized testing - Include detailed documentation for Keycloak integration setup Integration includes: - Real OIDC authentication flow with username/password - JWT Bearer token authentication for S3 operations - Role mapping from Keycloak roles to SeaweedFS IAM policies - Comprehensive test coverage for production scenarios - Automatic fallback to mock mode when Keycloak unavailable
122 lines
3.2 KiB
YAML
122 lines
3.2 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
# Keycloak OIDC Provider
|
|
keycloak:
|
|
image: quay.io/keycloak/keycloak:26.0.7
|
|
container_name: keycloak-iam-test
|
|
environment:
|
|
KEYCLOAK_ADMIN: admin
|
|
KEYCLOAK_ADMIN_PASSWORD: admin123
|
|
KC_HTTP_PORT: 8080
|
|
KC_HOSTNAME_STRICT: false
|
|
KC_HOSTNAME_STRICT_HTTPS: false
|
|
KC_HTTP_ENABLED: true
|
|
KC_HEALTH_ENABLED: true
|
|
ports:
|
|
- "8080:8080"
|
|
command:
|
|
- start-dev
|
|
- --import-realm
|
|
volumes:
|
|
- ./keycloak-realm.json:/opt/keycloak/data/import/realm.json:ro
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:8080/health/ready"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 60s
|
|
networks:
|
|
- seaweedfs-iam
|
|
|
|
# SeaweedFS Master
|
|
seaweedfs-master:
|
|
image: chrislusf/seaweedfs:latest
|
|
container_name: seaweedfs-master-iam
|
|
ports:
|
|
- "9333:9333"
|
|
- "19333:19333"
|
|
command: master -ip=seaweedfs-master -mdir=/data -volumeSizeLimitMB=50
|
|
volumes:
|
|
- seaweedfs-master-data:/data
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:9333/cluster/status"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
networks:
|
|
- seaweedfs-iam
|
|
|
|
# SeaweedFS Volume Server
|
|
seaweedfs-volume:
|
|
image: chrislusf/seaweedfs:latest
|
|
container_name: seaweedfs-volume-iam
|
|
ports:
|
|
- "8080:8080"
|
|
command: volume -ip=seaweedfs-volume -port=8080 -mserver=seaweedfs-master:9333 -dir=/data
|
|
volumes:
|
|
- seaweedfs-volume-data:/data
|
|
depends_on:
|
|
seaweedfs-master:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/status"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
networks:
|
|
- seaweedfs-iam
|
|
|
|
# SeaweedFS Filer
|
|
seaweedfs-filer:
|
|
image: chrislusf/seaweedfs:latest
|
|
container_name: seaweedfs-filer-iam
|
|
ports:
|
|
- "8888:8888"
|
|
- "18888:18888"
|
|
command: filer -ip=seaweedfs-filer -master=seaweedfs-master:9333
|
|
depends_on:
|
|
seaweedfs-master:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8888/"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
networks:
|
|
- seaweedfs-iam
|
|
|
|
# SeaweedFS S3 Gateway with IAM
|
|
seaweedfs-s3:
|
|
build:
|
|
context: ../../..
|
|
dockerfile: test/s3/iam/Dockerfile.s3
|
|
container_name: seaweedfs-s3-iam
|
|
ports:
|
|
- "8333:8333"
|
|
environment:
|
|
- KEYCLOAK_URL=http://keycloak:8080
|
|
command: s3 -port=8333 -filer=seaweedfs-filer:8888 -iam.config=/etc/seaweedfs/iam_config.json
|
|
volumes:
|
|
- ./iam_config_docker.json:/etc/seaweedfs/iam_config.json:ro
|
|
depends_on:
|
|
keycloak:
|
|
condition: service_healthy
|
|
seaweedfs-filer:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8333/"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
networks:
|
|
- seaweedfs-iam
|
|
|
|
volumes:
|
|
seaweedfs-master-data:
|
|
seaweedfs-volume-data:
|
|
|
|
networks:
|
|
seaweedfs-iam:
|
|
driver: bridge
|