Skip to main content

Graph Studio Deployment with Keycloak Authentication and Extra Imports

Overview & Use Case​

This configuration is used to deploy Graph Studio integrated with Keycloak Single Sign-On (SSO) authentication and custom dataset/configuration imports using extraImports. It is designed for enterprise deployments requiring centralized OIDC-based identity management via Keycloak, alongside automated mounting and importing of custom TriG RDF datasets or OSGi/system configurations during Graph Studio startup.

Key Highlights​

  • Keycloak SSO Integration: Configures spec.auth.authMode: EXTERNAL_KEYCLOAK and spec.auth.keycloak parameters including Keycloak host, SSL port, client credentials, realm details, display title, scope, and central logout behavior. The operator automatically generates the corresponding init.json authentication settings and keycloak.trig SSO provider file.
  • Extra Imports: Uses spec.extraImports to supply custom .trig datasets or configuration files (e.g., custom-config.trig) that are mounted into the extra-imports directory and imported into Graph Studio on initial boot.

Custom Resource Definition​

apiVersion: anzo.cambridgesemantics.com/v2
kind: Anzo
metadata:
  name: server
  namespace: "${NAMESPACE}"
spec:
  role: AnzoServer
  jsonActivation: true
  initJSON: |-
    {
      "sysadminUser": "k8s://anzo-server/admin_user",
      "password": "k8s://anzo-server/admin_password",
      "hostname": "server",
      "serverId": "${SERVER_ID}",
      "licenseEncoded": "${CSI_LICENSE}"
    }
  auth:
    authMode: EXTERNAL_KEYCLOAK
    keycloak:
      keycloakHost: keycloak.example.com
      keycloakSslPort: 443
      keycloakClientId: graph-studio-client
      keycloakClientRealm: graph-studio-realm
      keycloakClientSecret: ${KEYCLOAK_CLIENT_SECRET}
      title: Keycloak SSO
      callbackUserKey: email
      scope: openid
      trustAll: false
      useCentralLogout: true
  extraImports:
    custom-config.trig: |-
      @prefix ex: <http://example.com/> .
      ex:s ex:p ex:o .
  nodeConfig:
    spec:
      replicas: 1
      serviceName: graph-studio-server
      selector:
        matchLabels:
          app: graph-studio
      template:
        metadata:
          labels:
            app: graph-studio
        spec:
          serviceAccountName: anzo-operator
          containers:
          - name: graph-studio
            image: artifacts.altair.com/graph-docker/anzo:6.3.1