Integrations Reference
Overview
SmoothGlue pre-integrates all tools at install time. This page documents the integration configuration for the four core identity and delivery tools: Keycloak, GitLab, ArgoCD, and Vault. Each section covers what SmoothGlue configures automatically, what operators can customize, and where to find the live config in the Console.
Keycloak
Role: Identity provider and SSO hub for all platform tools.
What SmoothGlue configures automatically
- A
smoothgluerealm with FIPS-compatible token signing (RSA-2048) - One OIDC client per integrated tool:
gitlab,argocd,grafana,jira,mattermost,nexus - Default realm roles:
platform-admin,org-admin,org-privileged,org-user,platform-user - Password policy: minimum 12 characters, complexity enforced, FIPS-compliant hash (PBKDF2-SHA256)
- Session timeout: 8 hours (configurable)
Console location
Tools → Keycloak → Realm Settings
Operator-customizable fields
| Setting | Console path | Description |
|---|---|---|
| Session timeout | Realm Settings → Tokens | Adjust SSO session lifetime |
| Password policy | Realm Settings → Security Defenses | Add/remove complexity rules |
| Corporate IdP federation | Identity Providers → Add | Link SAML 2.0 or OIDC external IdP (e.g., Active Directory, Okta) |
| Group-to-role mapping | Groups → Mapper | Map corporate directory groups to SmoothGlue roles |
Known constraints
- Keycloak realm name is fixed at
smoothglue— changing it breaks all OIDC clients - FIPS mode cannot be disabled without rebuilding the Keycloak container
GitLab
Role: Source control, CI/CD pipelines, container registry, and package registry.
What SmoothGlue configures automatically
- GitLab instance with
rootadmin account (password printed atsmoothglue installcompletion) - OIDC SSO via Keycloak — all users authenticate through Keycloak, not native GitLab accounts
- GitLab Runner registered and ready for CI pipelines (Kubernetes executor, runs in
gitlab-runnernamespace) - Iron Bank proxy configured in Nexus — GitLab Runner pulls base images through the local mirror
- ArgoCD integration: GitLab webhooks trigger ArgoCD sync on push to the deploy branch
- Default groups: one group per SmoothGlue organization, matching Console org structure
Console location
Tools → GitLab → Instance Settings
Operator-customizable fields
| Setting | Console path | Description |
|---|---|---|
| Repository visibility defaults | GitLab → Settings → General | Internal vs. private default for new repos |
| Runner concurrency | GitLab → Runners | Increase parallel job limit (default: 4) |
| Container registry storage | GitLab → Settings → Registry | Configure external S3 storage for large image archives |
| Webhook configuration | GitLab → Settings → Webhooks | Add custom webhook targets beyond ArgoCD |
API access
GitLab API is available at https://gitlab.<your-domain>/api/v4. Authenticate with a personal access token (PAT) created in GitLab → User Settings → Access Tokens.
For service accounts (CI pipelines), use project-level deploy tokens rather than PATs.
ArgoCD
Role: GitOps continuous delivery — syncs Kubernetes manifests from Git to cluster.
What SmoothGlue configures automatically
- ArgoCD instance with SSO via Keycloak OIDC (no native ArgoCD accounts by default)
- RBAC mapped to SmoothGlue roles:
platform-admin→ ArgoCD admin;org-admin→ project-level write;org-user→ read-only - One ArgoCD
AppProjectper SmoothGlue organization — limits which namespaces and clusters each project can deploy to - Default sync policy: automated sync with pruning enabled, self-heal enabled
- GitLab webhook registered — ArgoCD syncs within 30 seconds of a push to the deploy branch
Console location
Tools → ArgoCD → Applications
Operator-customizable fields
| Setting | Console path / CLI | Description |
|---|---|---|
| Sync policy | ArgoCD → App → Settings | Disable auto-sync for manual promotion workflows |
| Sync windows | ArgoCD → Settings → Sync Windows | Block automated syncs during maintenance windows |
| Cluster registration | argocd cluster add | Register additional clusters for multi-cluster deployments |
| Notifications | ArgoCD → Settings → Notifications | Send sync events to Mattermost or Slack |
Application health checks
ArgoCD checks application health via Kubernetes resource status. For custom resources (CRDs), add a Lua health check script in the ArgoCD configmap. Contact your Platform Engineer for the standard SmoothGlue CRD health check library.
Vault
Role: Secrets management — stores and injects secrets into application workloads.
What SmoothGlue configures automatically
- Vault instance initialized and unsealed (auto-unseal via AWS KMS or KVM TPM)
- Kubernetes auth method enabled — pods authenticate using their ServiceAccount token
- One Vault namespace per SmoothGlue organization
- Vault Agent sidecar injection enabled — annotated pods receive secrets as files or environment variables at startup
- PKI secrets engine configured for cert-manager integration — Vault issues TLS certificates for Istio mTLS
- Transit secrets engine enabled for application-level encryption at rest
Console location
Tools → Vault → Secrets
Operator-customizable fields
| Setting | Console path / CLI | Description |
|---|---|---|
| Secret storage | Vault → Secrets Engines | Create KV v2 paths for application secrets |
| Policy assignment | Vault → Policies | Grant or restrict ServiceAccount access to secret paths |
| Dynamic credentials | Vault → Database Secrets Engine | Generate short-lived database credentials for app workloads |
| Auto-unseal provider | infra.yaml → vault.unseal | Switch between AWS KMS, GCP KMS, Azure Key Vault, or TPM |
Injecting secrets into application pods
Add these annotations to your pod spec to inject secrets at startup:
annotations:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/role: "my-app"
vault.hashicorp.com/agent-inject-secret-config.json: "secret/data/my-app/config"
The secret is mounted at /vault/secrets/config.json inside the container. No environment variables are created by default — use vault.hashicorp.com/agent-inject-template-* annotations for custom formats.