Initial Keycloak container setup

Signed-off-by: Matthias Wessendorf <[email protected]>

Author: matzew

Makefile

@@ -131,18 +131,18 @@ local-env-setup: ## Setup complete local development environment with Kind clust
 	@echo "========================================="
 	$(MAKE) tools
 	$(MAKE) kind-create-cluster
+	$(MAKE) keycloak-install
 	$(MAKE) build
 	@echo ""
 	@echo "========================================="
 	@echo "Local environment ready!"
 	@echo "========================================="
 	@echo ""
 	@echo "Run the MCP server with:"
-	@echo "  ./$(BINARY_NAME)"
+	@echo "  ./$(BINARY_NAME) --port ..."
 	@echo ""
 	@echo "Or run with MCP inspector:"
 	@echo "  npx @modelcontextprotocol/inspector@latest \$$(pwd)/$(BINARY_NAME)"
-	@echo ""
 
 .PHONY: local-env-teardown
 local-env-teardown: ## Tear down the local Kind cluster

build/keycloak.mk

@@ -0,0 +1,56 @@
+# Keycloak IdP for development and testing
+
+KEYCLOAK_NAMESPACE = keycloak
+KEYCLOAK_ADMIN_USER = admin
+KEYCLOAK_ADMIN_PASSWORD = admin
+
+.PHONY: keycloak-install
+keycloak-install: ## Install Keycloak for local development
+	@echo "Installing Keycloak (dev mode using official image)..."
+	@kubectl apply -f config/keycloak/deployment.yaml
+	@echo "Waiting for Keycloak to be ready..."
+	@kubectl wait --for=condition=ready pod -l app=keycloak -n $(KEYCLOAK_NAMESPACE) --timeout=120s || true
+	@echo ""
+	@echo "Keycloak installed!"
+	@echo "Admin credentials: $(KEYCLOAK_ADMIN_USER) / $(KEYCLOAK_ADMIN_PASSWORD)"
+	@echo "Run 'make keycloak-forward' to access at http://localhost:8090"
+
+.PHONY: keycloak-uninstall
+keycloak-uninstall: ## Uninstall Keycloak
+	@kubectl delete -f config/keycloak/deployment.yaml 2>/dev/null || true
+
+.PHONY: keycloak-forward
+keycloak-forward: ## Port forward Keycloak to localhost:8090
+	@echo "Forwarding Keycloak to http://localhost:8090"
+	@echo "Login: $(KEYCLOAK_ADMIN_USER) / $(KEYCLOAK_ADMIN_PASSWORD)"
+	kubectl port-forward -n $(KEYCLOAK_NAMESPACE) svc/keycloak 8090:80
+
+.PHONY: keycloak-status
+keycloak-status: ## Show Keycloak status and connection info
+	@if kubectl get svc -n $(KEYCLOAK_NAMESPACE) keycloak >/dev/null 2>&1; then \
+		echo "========================================"; \
+		echo "Keycloak Status"; \
+		echo "========================================"; \
+		echo ""; \
+		echo "Status: Installed"; \
+		echo ""; \
+		echo "Admin Console:"; \
+		echo "  URL: http://localhost:8090 (run: make keycloak-forward)"; \
+		echo "  Username: $(KEYCLOAK_ADMIN_USER)"; \
+		echo "  Password: $(KEYCLOAK_ADMIN_PASSWORD)"; \
+		echo ""; \
+		echo "OIDC Endpoints (master realm):"; \
+		echo "  Discovery: http://localhost:8090/realms/master/.well-known/openid-configuration"; \
+		echo "  Token:     http://localhost:8090/realms/master/protocol/openid-connect/token"; \
+		echo "  Authorize: http://localhost:8090/realms/master/protocol/openid-connect/auth"; \
+		echo "  UserInfo:  http://localhost:8090/realms/master/protocol/openid-connect/userinfo"; \
+		echo "  JWKS:      http://localhost:8090/realms/master/protocol/openid-connect/certs"; \
+		echo ""; \
+		echo "========================================"; \
+	else \
+		echo "Keycloak is not installed. Run: make keycloak-install"; \
+	fi
+
+.PHONY: keycloak-logs
+keycloak-logs: ## Tail Keycloak logs
+	@kubectl logs -n $(KEYCLOAK_NAMESPACE) -l app=keycloak -f --tail=100

config/keycloak/deployment.yaml

@@ -0,0 +1,71 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keycloak
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+  namespace: keycloak
+  labels:
+    app: keycloak
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+      - name: keycloak
+        image: quay.io/keycloak/keycloak:26.4
+        args: ["start-dev"]
+        env:
+        - name: KEYCLOAK_ADMIN
+          value: "admin"
+        - name: KEYCLOAK_ADMIN_PASSWORD
+          value: "admin"
+        - name: KC_PROXY
+          value: "edge"
+        - name: KC_HOSTNAME_STRICT
+          value: "false"
+        - name: KC_HTTP_ENABLED
+          value: "true"
+        - name: KC_HEALTH_ENABLED
+          value: "true"
+        ports:
+        - name: http
+          containerPort: 8080
+        readinessProbe:
+          httpGet:
+            path: /health/ready
+            port: 9000
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health/live
+            port: 9000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  namespace: keycloak
+  labels:
+    app: keycloak
+spec:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8080
+  selector:
+    app: keycloak
+  type: ClusterIP