keycloak.yaml

---
# Source: keycloak/templates/configmap-sh.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: NAMESPACE_NAME-keycl-sh
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
    category: configmap
data:
  keycloak.sh: |
    #!/usr/bin/env bash

    set -o errexit
    set -o nounset

    exec /opt/jboss/tools/docker-entrypoint.sh -b 0.0.0.0 -Djgroups.bind_addr=global -Dkeycloak.migration.action=import -Dkeycloak.migration.provider=singleFile -Dkeycloak.migration.file=/opt/jboss/keycloak/standalone/configuration/import/stakater-realm.json -Dkeycloak.migration.strategy=IGNORE_EXISTING -c standalone.xml

---
# Source: keycloak/templates/configmap-startup.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: NAMESPACE_NAME-keycl-startup
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
    category: configmap
data:
  keycloak.cli: |
    embed-server --std-out=echo
    batch
    ## Sets the node identifier to the node name (= pod name). Node identifiers have to be unique. They can have a
    ## maximum length of 23 characters. Thus, the chart's fullname template truncates its length accordingly.
    /subsystem=transactions:write-attribute(name=node-identifier, value=${jboss.node.name})


    # Allow log level to be configured via environment variable
    /subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=${env.WILDFLY_LOGLEVEL:INFO})
    /subsystem=logging/root-logger=ROOT:write-attribute(name=level, value=${env.WILDFLY_LOGLEVEL:INFO})

    # Add dedicated eventsListener config element to allow configuring elements.
    /subsystem=keycloak-server/spi=eventsListener:add()
    /subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:add(enabled=true)

    # Propagate success events to INFO instead of DEBUG, to expose successful logins for log analysis
    /subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:write-attribute(name=properties.success-level,value=info)
    /subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:write-attribute(name=properties.error-level,value=warn)


    # Configure datasource to use explicit query timeout in seconds
    /subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=query-timeout,value=${env.DB_QUERY_TIMEOUT:300})

    # Configure datasource to connection before use
    /subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=validate-on-match,value=${env.DB_VALIDATE_ON_MATCH:true})

    # Configure datasource to try all other connections before failing
    /subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=use-fast-fail,value=${env.DB_USE_CAST_FAIL:false})



    run-batch
    stop-embedded-server
---
# Source: keycloak/templates/test/configmap-test.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: NAMESPACE_NAME-keycl-test
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
    category: configmap
data:
  test.py: |
    import os
    from selenium import webdriver
    from selenium.webdriver.common.by import By
    from selenium.webdriver.support.ui import WebDriverWait
    from selenium.webdriver.support import expected_conditions
    from urllib.parse import urlparse

    print('Creating PhantomJS driver...')
    driver = webdriver.PhantomJS(service_log_path='/tmp/ghostdriver.log')

    base_url = 'http://NAMESPACE_NAME-keycl-http'

    print('Opening Keycloak...')
    driver.get('{0}/auth/admin/'.format(base_url))

    username = os.environ['KEYCLOAK_USER']
    password = os.environ['KEYCLOAK_PASSWORD']

    username_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "username")))
    password_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "password")))
    login_button = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "kc-login")))

    print('Entering username...')
    username_input.send_keys(username)

    print('Entering password...')
    password_input.send_keys(password)

    print('Clicking login button...')
    login_button.click()

    current_url = urlparse(driver.current_url)
    expected_url = urlparse('{0}/auth/admin/master/console/'.format(base_url))

    print('Current URL: {0}'.format(current_url))
    print('Expected URL: {0}'.format(expected_url))

    if current_url.path != expected_url.path:
        print('Login failed. Current url is not expected url')
        exit(1)

    print('URLs match. Login successful.')

    driver.quit()

---
# Source: keycloak/templates/service-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: NAMESPACE_NAME-keycl-headless
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
  selector:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak

---
# Source: keycloak/templates/service-http.yaml
apiVersion: v1
kind: Service
metadata:
  name: NAMESPACE_NAME-keycl-http
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
    expose: "true"

spec:
  type: ClusterIP
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
  selector:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak

---
# Source: keycloak/templates/test/pod-test.yaml

apiVersion: v1
kind: Pod
metadata:
  name: "NAMESPACE_NAME-keycl-test-zkk2v"
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
    role: test
    category: tool
  annotations:
    "helm.sh/hook": test-success
spec:
  securityContext:
    fsGroup: 1000

  containers:
    - name: keycloak-test
      image: "unguiculus/docker-python3-phantomjs-selenium:v1"
      imagePullPolicy: IfNotPresent
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000

      command:
        - python3
        - /tests/test.py
      env:
        - name: KEYCLOAK_USER
          value: stakater
        - name: KEYCLOAK_PASSWORD
          valueFrom:
            secretKeyRef:
              name: keycloak-secrets
              key: password
      volumeMounts:
        - name: tests
          mountPath: /tests
  volumes:
    - name: tests
      configMap:
        name: NAMESPACE_NAME-keycl-test
  restartPolicy: Never

---
# Source: keycloak/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: NAMESPACE_NAME-keycl
  labels:
    app.kubernetes.io/name: keycloak
    helm.sh/chart: keycloak-5.1.7
    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
    app.kubernetes.io/managed-by: Tiller
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
  replicas: 1
  serviceName: NAMESPACE_NAME-keycl-headless
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: keycloak
        app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
        category: tool
      annotations:
        checksum/config-sh: 583368041190243b2cdf4e216f1896f2af1f99a604a8ce955b2f6e5565fcc645
        checksum/config-startup: 9a25f6b64bf35395cda7f9cc7f8780f511e4e9934c245ac6a14400b72310e58e
        fluentdConfiguration: |
          [
              {
                  "containers":
                  [
                      {
                          "expression": "/^\\S*\\s-\\s-\\s\\[(?<time>\\S*)[\\S\\s]*\\]\\s(?<message>[\\S\\s]*)/",
                          "expressionFirstLine": "/^\\:\\:f{4}:[0-9]+.[0-9]+\\.[0-9]+\\.[0-9]+/",
                          "timeFormat": "%d/%b/%Y:%H:%M:%S",
                          "containerName": "keycloak"
                      }
                  ]
              }
          ]
        secret.reloader.stakater.com/reload: keycloak-config,keycloak-secrets

    spec:
      restartPolicy: Always
      serviceAccountName: default
      securityContext:
        fsGroup: 1000

      containers:
        - name: keycloak
          image: "jboss/keycloak:8.0.1"
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000

          command:
            - /scripts/keycloak.sh
          env:
            - name: KEYCLOAK_USER
              value: stakater
            - name: KEYCLOAK_PASSWORD_FILE
              value: /secrets/password

            - name: DB_VENDOR
              value: "postgres"
            - name: DB_ADDR
              value: "NAMESPACE_NAME-postgresql"
            - name: DB_PORT
              value: "5432"
            - name: DB_DATABASE
              value: "keycloak-db"
            - name: DB_USER
              value: "keycloak"
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: keycloak-secrets
                  key: "db.password"
            - name: OPERATING_MODE
              value: standalone
            - name: HIDE_OPENSHIFT_BTN
              value: "true"
            - name: HIDE_GITHUB_BTN
              value: "false"
            - name: PROXY_ADDRESS_FORWARDING # Why? https://www.keycloak.org/docs/3.4/server_installation/index.html#identifying-client-ip-addresses
              value: "true"
            - name: K8S_API_SERVER
              value: http://kubernetes
            - name: AUTH_URL
              value: http://auth
            - name: KEYCLOAK_URL
              value: http://keycloak

          volumeMounts:
            - name: sh
              mountPath: /scripts
              readOnly: true
            - name: secrets
              mountPath: /secrets
              readOnly: true
            - name: startup
              mountPath: /opt/jboss/startup-scripts
              readOnly: true
            - name: keycloak-config
              mountPath: /opt/jboss/keycloak/standalone/configuration/import/stakater-realm.json
              subPath: stakater-realm.json
            - name: data
              mountPath: /opt/jboss/keycloak/standalone/deployments

          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /auth/
              port: http
            initialDelaySeconds: 120
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /auth/realms/master
              port: http
            initialDelaySeconds: 30
            timeoutSeconds: 1
          resources:
            {}

      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: keycloak
                  app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
                matchExpressions:
                  - key: role
                    operator: NotIn
                    values:
                      - test
              topologyKey: kubernetes.io/hostname
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/name: keycloak
                    app.kubernetes.io/instance: NAMESPACE_NAME-keycloak
                  matchExpressions:
                    - key: role
                      operator: NotIn
                      values:
                        - test
                topologyKey: failure-domain.beta.kubernetes.io/zone

      terminationGracePeriodSeconds: 60
      volumes:
        - name: sh
          configMap:
            name: NAMESPACE_NAME-keycl-sh
            defaultMode: 0555
        - name: secrets
          secret:
            secretName: keycloak-secrets
        - name: startup
          configMap:
            name: NAMESPACE_NAME-keycl-startup
            defaultMode: 0555
        - name: keycloak-config
          secret:
            secretName: keycloak-config
            items:
              - key: stakater-realm.json
                path: stakater-realm.json
        - name: data
          emptyDir: {}


---
# Source: keycloak/templates/ingress.yaml

---
# Source: keycloak/templates/poddisruptionbudget.yaml

---
# Source: keycloak/templates/route.yaml

---
# Source: keycloak/templates/secret-db.yaml

---
# Source: keycloak/templates/secret-keycloak.yaml


---
# Source: keycloak/templates/serviceaccount.yaml