89 lines
2.4 KiB
YAML
89 lines
2.4 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: keycloak-deployment
|
|
namespace: keycloak
|
|
labels:
|
|
app: keycloak
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: keycloak
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: keycloak
|
|
spec:
|
|
containers:
|
|
- name: keycloak-db
|
|
image: docker.io/library/postgres:bullseye
|
|
volumeMounts:
|
|
- name: db-storage
|
|
mountPath: "/var/lib/postgresql/data"
|
|
env:
|
|
- name: POSTGRES_DB
|
|
value: keycloak
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-db-secret
|
|
key: POSTGRES_PASSWORD
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command: ["/usr/local/bin/pg_ctl stop -D /var/lib/postgresql/data -w -t 60 -m fast"]
|
|
- name: keycloak
|
|
image: harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0
|
|
env:
|
|
- name: KC_LOG_LEVEL
|
|
value: DEBUG
|
|
- name: KEYCLOAK_ADMIN
|
|
value: admin
|
|
- name: KEYCLOAK_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-secret
|
|
key: KEYCLOAK_ADMIN_PASSWORD
|
|
- name: KC_DB
|
|
value: postgres
|
|
- name: KC_DB_USERNAME
|
|
value: postgres
|
|
- name: KC_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-secret
|
|
key: KC_DB_PASSWORD
|
|
- name: KC_SPI_X509CERT_LOOKUP_PROVIDER
|
|
value: "nginx"
|
|
- name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
|
|
value: "ssl-client-cert"
|
|
- name: KC_TRUSTSTORE_PATHS
|
|
value: "/opt/keycloak-config/jpace121-ca.pem"
|
|
- name: KC_HTTPS_CLIENT_AUTH
|
|
value: "request"
|
|
- name: KC_HOSTNAME
|
|
value: "https://auth.jpace121.net"
|
|
- name: KC_HOSTNAME_ADMIN
|
|
value: "https://auth.jpace121.net"
|
|
- name: KC_HOSTNAME_STRICT
|
|
value: "true"
|
|
- name: KC_PROXY_HEADERS
|
|
value: "xforwarded"
|
|
- name: KC_HTTP_ENABLED
|
|
value: "true"
|
|
volumeMounts:
|
|
- name: keycloak-config
|
|
mountPath: /opt/keycloak-config/
|
|
args:
|
|
- start
|
|
volumes:
|
|
- name: db-storage
|
|
persistentVolumeClaim:
|
|
claimName: keycloak-db-pvc
|
|
- name: keycloak-config
|
|
configMap:
|
|
name: keycloak-config |