feat(keycloak): extraVolumes/extraVolumeMounts for custom themes and providers (1.1.0+up26.8.0)

keycloak/templates/keycloak.deployment.yaml

@@ -146,6 +146,23 @@ spec:
               mountPath: {{ include "keycloak.dataDir" . }}
             - name: tmp
               mountPath: /tmp
+            {{- with .Values.keycloak.extraVolumeMounts }}
+            # THE EXTRA MOUNTS, HERE AS WELL AS ON THE SERVING CONTAINER, AND
+            # THIS OCCURRENCE IS THE LOAD-BEARING ONE (Gitea #88). Do not
+            # "clean it up" to the serving container only: an SPI provider JAR
+            # is a BUILD-time concern. Upstream, on adding one: "After that if
+            # you are using `--optimized`, you must run the `build` command in
+            # order to update the server's provider registry with the
+            # implementations from the JAR file." That build is THIS container,
+            # so a JAR mounted only below is absent while the registry is
+            # written - it never gets registered and nothing reports it.
+            #
+            # One list for both places on purpose: two lists would be two
+            # chances to mount an extension in the wrong one, and the wrong one
+            # fails silently. The price is that every extra volume is present at
+            # build time too, which values.yaml names at the value.
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           # Fully qualified: an unqualified reference would resolve to Docker
@@ -358,6 +375,13 @@ spec:
               mountPath: {{ include "keycloak.dataDir" . }}
             - name: tmp
               mountPath: /tmp
+            {{- with .Values.keycloak.extraVolumeMounts }}
+            # The extra mounts, second of the two places (see the build init
+            # container above). This is where a login THEME is read - themes are
+            # a runtime concern, so one mounted here takes effect even though
+            # this container serves a pre-built installation.
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           # DELIBERATELY NOT MOUNTED: /opt/keycloak/conf. It is not empty in
           # the image - it carries keycloak.conf and, more importantly,
           # cache-ispn.xml, which is the Infinispan configuration cache=ispn
@@ -371,3 +395,11 @@ spec:
           emptyDir: {}
         - name: tmp
           emptyDir: {}
+        {{- with .Values.keycloak.extraVolumes }}
+        # Verbatim, because a volume source can be any of the Kubernetes forms
+        # and the chart interprets none of them. The one path rule that matters
+        # is about the MOUNT and not the volume: never /opt/keycloak/themes
+        # itself, which would hide the image's base, keycloak and keycloak.v2
+        # themes - see values.yaml at keycloak.extraVolumes.
+        {{- toYaml . | nindent 8 }}
+        {{- end }}