Reconcile Keycloak bootstrap access

cyber-stack/base/schema-migrator/bootstrap-job.yaml

@@ -41,8 +41,8 @@ spec:
                   --config "$CONFIG" \
                   --server "$KEYCLOAK_URL" \
                   --realm master \
-                  --user "$KEYCLOAK_ADMIN" \
-                  --password - <<< "$KEYCLOAK_ADMIN_PASSWORD" >/dev/null 2>&1; then
+                  --client "$KEYCLOAK_ADMIN_CLIENT_ID" \
+                  --secret "$KEYCLOAK_ADMIN_CLIENT_SECRET" >/dev/null 2>&1; then
                   authenticated=true
                   break
                 fi
@@ -53,6 +53,24 @@ spec:
                 exit 1
               fi
 
+              cleanup_bootstrap_admin() {
+                set +e
+                recovery_client_uuid="$($KCADM get clients --config "$CONFIG" -r master \
+                  -q "clientId=$KEYCLOAK_ADMIN_CLIENT_ID" --fields id --format csv --noquotes \
+                  | grep -v '^id$' | head -n 1)"
+                if [ -n "$recovery_client_uuid" ]; then
+                  "$KCADM" delete "clients/$recovery_client_uuid" --config "$CONFIG" -r master
+                fi
+              }
+              trap cleanup_bootstrap_admin EXIT
+
+              stale_admin_id="$($KCADM get users --config "$CONFIG" -r master \
+                -q "username=keycloak-admin" -q exact=true --fields id --format csv --noquotes \
+                | grep -v '^id$' | head -n 1)"
+              if [ -n "$stale_admin_id" ]; then
+                "$KCADM" delete "users/$stale_admin_id" --config "$CONFIG" -r master
+              fi
+
               user_id="$($KCADM get users --config "$CONFIG" -r "$REALM" \
                 -q "username=$APP_USERNAME" -q exact=true --fields id --format csv --noquotes \
                 | grep -v '^id$' | head -n 1)"
@@ -97,9 +115,9 @@ spec:
           env:
             - name: KEYCLOAK_URL
               value: "http://ssl-proxy-schema-migrator-keycloak:8080"
-            - name: KEYCLOAK_ADMIN
-              value: "keycloak-admin"
-            - name: KEYCLOAK_ADMIN_PASSWORD
+            - name: KEYCLOAK_ADMIN_CLIENT_ID
+              value: "ssl-proxy-bootstrap"
+            - name: KEYCLOAK_ADMIN_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   name: schema-migrator-keycloak

cyber-stack/base/schema-migrator/keycloak.yaml

@@ -97,6 +97,72 @@ spec:
           volumeMounts:
             - name: keycloak-home
               mountPath: /keycloak-home
+        - name: bootstrap-admin-service
+          image: quay.io/keycloak/keycloak:26.2.5
+          imagePullPolicy: Always
+          command: ["/opt/keycloak/bin/kc.sh"]
+          args:
+            - bootstrap-admin
+            - service
+            - --client-id
+            - ssl-proxy-bootstrap
+            - --client-secret:env
+            - KC_BOOTSTRAP_RECOVERY_CLIENT_SECRET
+            - --no-prompt
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: KC_DB
+              value: mysql
+            - name: KC_DB_URL_HOST
+              value: "ssl-proxy-tidb.$(POD_NAMESPACE).svc.cluster.local"
+            - name: KC_DB_URL_PORT
+              value: "4000"
+            - name: KC_DB_URL_DATABASE
+              value: "keycloak"
+            - name: KC_DB_URL_PROPERTIES
+              value: "?sslMode=VERIFY_IDENTITY&trustCertificateKeyStoreUrl=file:///run/tidb-tls/truststore.p12&trustCertificateKeyStoreType=PKCS12&trustCertificateKeyStorePassword=changeit&fallbackToSystemTrustStore=false"
+            - name: KC_DB_USERNAME
+              value: "keycloak"
+            - name: KC_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: tidb-keycloak
+                  key: password
+            - name: KC_BOOTSTRAP_RECOVERY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: schema-migrator-keycloak
+                  key: bootstrap-admin-password
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+              ephemeral-storage: 250Mi
+            limits:
+              cpu: 500m
+              memory: 1Gi
+              ephemeral-storage: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+          volumeMounts:
+            - name: keycloak-home
+              mountPath: /opt/keycloak
+            - name: keycloak-data
+              mountPath: /opt/keycloak/data
+            - name: tmp
+              mountPath: /tmp
+            - name: tidb-truststore
+              mountPath: /run/tidb-tls
+              readOnly: true
       containers:
         - name: keycloak
           image: quay.io/keycloak/keycloak:26.2.5
@@ -129,13 +195,6 @@ spec:
                 secretKeyRef:
                   name: tidb-keycloak
                   key: password
-            - name: KC_BOOTSTRAP_ADMIN_USERNAME
-              value: "keycloak-admin"
-            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: schema-migrator-keycloak
-                  key: bootstrap-admin-password
             - name: IDENTITY_HOSTNAME
               valueFrom:
                 configMapKeyRef:

src/blocklist.rs

@@ -12,7 +12,7 @@ use crate::state::SharedState;
 
 /// Remote source of the periodically refreshed domain blocklist.
 pub const BLOCKLIST_URL: &str =
-    "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/ultimate-onlydomains.txt";
+    "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/ultimate.txt";
 const REFRESH_INTERVAL_SECS: u64 = 86_400;
 const INITIAL_FETCH_JITTER_MAX_SECS: u64 = 60;
 const MAX_LABEL_WALK_DEPTH: usize = 10;