chore: Switch Keycloak to managed DB service

[martyngigg]

Summary

Keycloak was using a postgres DB hosted on the same node. This switches to a DB managed by DB services.

This has been deployed to the QA infrastructure.

Summary by CodeRabbit

Release Notes

• Infrastructure
  • Enhanced database configuration security by implementing vault-backed credential management.
  • Improved deployment flexibility with configurable database host and port settings instead of hardcoded values.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request decouples Keycloak deployment from local PostgreSQL provisioning. The postgres role is removed from the deployment playbook, database configuration switches to vault-backed variables, and the database host reference changes from "postgres" to a vault-defined remote host.

Changes

Cohort / File(s)	Summary
Keycloak Deployment Configuration infra/ansible-docker/playbooks/keycloak/group_vars/keycloak.yml	Updated database credentials from hardcoded values to vault-backed variables (vault_keycloak_db_name, vault_keycloak_db_user). Removed local PostgreSQL-specific configuration block including postgres port, user, password, and data path settings.
Keycloak Container Environment infra/ansible-docker/roles/keycloak/tasks/main.yml	Modified KC_DB_URL to reference vault-defined database host and port (vault_db_host:vault_db_port) instead of hardcoded "postgres" hostname with keycloak database port.
Keycloak Deployment Playbook infra/ansible-docker/playbooks/keycloak/deploy.yml	Removed postgres role execution from the keycloak deployment sequence, eliminating local database provisioning from this workflow.

Poem

🐰 Hop away, postgres local role,
Vault secrets now make our database whole!
Remote hosts and credentials so secure,
Our keycloak deployment's now truly pure!
Infrastructure dancing in harmony bright! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: switching Keycloak from a local PostgreSQL database to a managed DB service, as evidenced by removal of postgres role, vault-backed DB variables, and updated host/port configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}