d7c6464ad6
Closes #27353 Signed-off-by: Michal Hajas <mhajas@redhat.com> Signed-off-by: Alexander Schwartz <aschwart@redhat.com> Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
866 lines
32 KiB
YAML
866 lines
32 KiB
YAML
---
|
|
# Source: keycloak/templates/infinispan/remote-store-secret.yaml
|
|
# tag::keycloak-ispn-secret[]
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: remote-store-secret
|
|
namespace: keycloak
|
|
type: Opaque
|
|
data:
|
|
username: ZGV2ZWxvcGVy # base64 encoding for 'developer'
|
|
password: c2VjdXJlX3Bhc3N3b3Jk # base64 encoding for 'secure_password'
|
|
# end::keycloak-ispn-secret[]
|
|
---
|
|
# Source: keycloak/templates/keycloak-db-secret.yaml
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: keycloak-db-secret
|
|
namespace: keycloak
|
|
type: Opaque
|
|
data:
|
|
username: a2V5Y2xvYWs= # keycloak
|
|
password: c2VjcmV0OTk= # secret99
|
|
---
|
|
# Source: keycloak/templates/keycloak-initial-admin-secret.yaml
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app: keycloak
|
|
name: keycloak-preconfigured-admin
|
|
namespace: keycloak
|
|
type: kubernetes.io/basic-auth
|
|
data:
|
|
password: YWRtaW4= # admin by default
|
|
username: YWRtaW4= # admin
|
|
---
|
|
# Source: keycloak/templates/keycloak-tls-secret.yaml
|
|
apiVersion: v1
|
|
data:
|
|
tls.crt: ...
|
|
tls.key: ...
|
|
kind: Secret
|
|
metadata:
|
|
name: keycloak-tls-secret
|
|
namespace: keycloak
|
|
type: kubernetes.io/tls
|
|
---
|
|
# Source: keycloak/templates/keycloak-infinispan-configmap.yaml
|
|
# tag::keycloak-ispn-configmap[]
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kcb-infinispan-cache-config
|
|
namespace: keycloak
|
|
data:
|
|
kcb-infinispan-cache-remote-store-config.xml: |
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!-- end::keycloak-ispn-configmap[] -->
|
|
|
|
<!--
|
|
~ Copyright 2019 Red Hat, Inc. and/or its affiliates
|
|
~ and other contributors as indicated by the @author tags.
|
|
~
|
|
~ Licensed under the Apache License, Version 2.0 (the "License");
|
|
~ you may not use this file except in compliance with the License.
|
|
~ You may obtain a copy of the License at
|
|
~
|
|
~ http://www.apache.org/licenses/LICENSE-2.0
|
|
~
|
|
~ Unless required by applicable law or agreed to in writing, software
|
|
~ distributed under the License is distributed on an "AS IS" BASIS,
|
|
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
~ See the License for the specific language governing permissions and
|
|
~ limitations under the License.
|
|
-->
|
|
|
|
<!--tag::keycloak-ispn-configmap[] -->
|
|
<infinispan
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="urn:infinispan:config:14.0 https://www.infinispan.org/schemas/infinispan-config-14.0.xsd
|
|
urn:infinispan:config:store:remote:14.0 https://www.infinispan.org/schemas/infinispan-cachestore-remote-config-14.0.xsd"
|
|
xmlns="urn:infinispan:config:14.0">
|
|
<!--end::keycloak-ispn-configmap[] -->
|
|
|
|
<!-- the statistics="true" attribute is not part of the original KC config and was added by Keycloak Benchmark -->
|
|
<cache-container name="keycloak" statistics="true">
|
|
<transport lock-timeout="60000"/>
|
|
<metrics names-as-tags="true" />
|
|
<local-cache name="realms" simple-cache="true" statistics="true">
|
|
<encoding>
|
|
<key media-type="application/x-java-object"/>
|
|
<value media-type="application/x-java-object"/>
|
|
</encoding>
|
|
<memory max-count="10000"/>
|
|
</local-cache>
|
|
<local-cache name="users" simple-cache="true" statistics="true">
|
|
<encoding>
|
|
<key media-type="application/x-java-object"/>
|
|
<value media-type="application/x-java-object"/>
|
|
</encoding>
|
|
<memory max-count="10000"/>
|
|
</local-cache>
|
|
<!--tag::keycloak-ispn-remotestore[] -->
|
|
<distributed-cache name="sessions" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false"> <!--1-->
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="sessions"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<!-- This is a workaround for the following issue https://github.com/keycloak/keycloak/issues/27117 and should be removed when the issue is fixed -->
|
|
<write-behind modification-queue-size="1024"/>
|
|
<!-- End of the workaround -->
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/> <!--2-->
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/> <!--3-->
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3"
|
|
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/> <!--4-->
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<!--end::keycloak-ispn-remotestore[] -->
|
|
<distributed-cache name="authenticationSessions" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="authenticationSessions"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3"
|
|
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<distributed-cache name="offlineSessions" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="offlineSessions"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3"
|
|
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<distributed-cache name="clientSessions" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="clientSessions"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<distributed-cache name="offlineClientSessions" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="offlineClientSessions"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<distributed-cache name="loginFailures" owners="2" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="loginFailures"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
<local-cache name="authorization" simple-cache="true" statistics="true">
|
|
<encoding>
|
|
<key media-type="application/x-java-object"/>
|
|
<value media-type="application/x-java-object"/>
|
|
</encoding>
|
|
<memory max-count="10000"/>
|
|
</local-cache>
|
|
<!--tag::keycloak-ispn-remotestore-work[] -->
|
|
<replicated-cache name="work" statistics="true">
|
|
<expiration lifespan="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="work"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</replicated-cache>
|
|
<!--end::keycloak-ispn-remotestore-work[] -->
|
|
<local-cache name="keys" simple-cache="true" statistics="true">
|
|
<encoding>
|
|
<key media-type="application/x-java-object"/>
|
|
<value media-type="application/x-java-object"/>
|
|
</encoding>
|
|
<expiration max-idle="3600000"/>
|
|
<memory max-count="1000"/>
|
|
</local-cache>
|
|
<distributed-cache name="actionTokens" owners="2" statistics="true">
|
|
<encoding>
|
|
<key media-type="application/x-java-object"/>
|
|
<value media-type="application/x-java-object"/>
|
|
</encoding>
|
|
<expiration max-idle="-1" lifespan="-1" interval="300000"/>
|
|
<memory max-count="-1"/>
|
|
<persistence passivation="false">
|
|
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
|
|
cache="actionTokens"
|
|
raw-values="true"
|
|
shared="true"
|
|
segmented="false">
|
|
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
|
|
port="${env.KC_REMOTE_STORE_PORT}"/>
|
|
<connection-pool max-active="16"
|
|
exhausted-action="CREATE_NEW"/>
|
|
<security>
|
|
<authentication server-name="infinispan">
|
|
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
|
|
password="${env.KC_REMOTE_STORE_PASSWORD}"
|
|
realm="default"/>
|
|
</authentication>
|
|
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
|
|
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
|
|
type="pem"/>
|
|
</encryption>
|
|
</security>
|
|
</remote-store>
|
|
</persistence>
|
|
</distributed-cache>
|
|
</cache-container>
|
|
</infinispan>
|
|
---
|
|
# Source: keycloak/templates/keycloak-providers-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: keycloak-providers
|
|
namespace: keycloak
|
|
binaryData:
|
|
keycloak-benchmark-dataset-0.12-SNAPSHOT.jar: ...
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-exporter-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: postgres-exporter
|
|
namespace: keycloak
|
|
data:
|
|
pgexporter-queries.yaml: |
|
|
# This is configuration file for postgres_exporter.
|
|
# Add custom metrics via SQL statements here as described here: https://github.com/prometheus-community/postgres_exporter#adding-new-metrics-via-a-config-file
|
|
# See https://github.com/prometheus-community/postgres_exporter/blob/master/queries.yaml for examples.
|
|
pg_locks_waiting:
|
|
# language=SQL
|
|
query: |
|
|
WITH q_locks AS (select * from pg_locks where granted = false and pid != pg_backend_pid())
|
|
SELECT (select current_database()) as datname, lower(lockmodes) AS mode, coalesce((select count(*) FROM q_locks WHERE mode = lockmodes), 0) AS count FROM
|
|
unnest('{AccessShareLock, ExclusiveLock, RowShareLock, RowExclusiveLock, ShareLock, ShareRowExclusiveLock, AccessExclusiveLock, ShareUpdateExclusiveLock}'::text[]) lockmodes;
|
|
metrics:
|
|
- datname:
|
|
usage: "LABEL"
|
|
description: "Database name"
|
|
- mode:
|
|
usage: "LABEL"
|
|
description: "Lock type"
|
|
- count:
|
|
usage: "GAUGE"
|
|
description: "Number of locks"
|
|
---
|
|
# Source: keycloak/templates/keycloak-jvmdebug-service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: keycloak
|
|
name: keycloak-jvmdebug
|
|
namespace: keycloak
|
|
spec:
|
|
type: NodePort
|
|
ports:
|
|
- name: jvmdebug
|
|
port: 8787
|
|
protocol: TCP
|
|
nodePort: 30012
|
|
selector:
|
|
app: keycloak
|
|
sessionAffinity: None
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-exporter.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: postgres-exporter
|
|
name: postgres-exporter
|
|
namespace: keycloak
|
|
spec:
|
|
ports:
|
|
- port: 9187
|
|
name: metrics
|
|
protocol: TCP
|
|
targetPort: 9187
|
|
selector:
|
|
app: postgres-exporter
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-nodeport.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres-nodeport
|
|
namespace: keycloak
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
type: NodePort
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
nodePort: 30009
|
|
selector:
|
|
app: postgres
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
name: postgres
|
|
namespace: keycloak
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
targetPort: 5432
|
|
selector:
|
|
app: postgres
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
# Source: keycloak/templates/sqlpad.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: sqlpad
|
|
name: sqlpad
|
|
namespace: keycloak
|
|
spec:
|
|
ports:
|
|
- port: 3000
|
|
protocol: TCP
|
|
targetPort: 3000
|
|
selector:
|
|
app: sqlpad
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
name: postgres
|
|
namespace: keycloak
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- imagePullPolicy: Always
|
|
env:
|
|
- name: POSTGRES_PASSWORD
|
|
value: secret99
|
|
- name: POSTGRES_USER
|
|
value: keycloak
|
|
- name: POSTGRES_DB
|
|
value: keycloak
|
|
image: postgres:13.2
|
|
args:
|
|
# default of max_prepared_transactions is 0, and this setting should match the number of active connections
|
|
# so that running Quarkus with JTA and more than one data store can prepare transactions.
|
|
- -c
|
|
- max_prepared_transactions=100
|
|
resources:
|
|
requests:
|
|
cpu: "0"
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 5432
|
|
failureThreshold: 20
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 2
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 5432
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 5432
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
name: postgres
|
|
ports:
|
|
- containerPort: 5432
|
|
protocol: TCP
|
|
restartPolicy: Always
|
|
# The rhel9/postgresql-13 is known to take ~30 seconds to shut down
|
|
# As this is a deployment with ephemeral storage, there is no need to wait as the data will be gone anyway
|
|
terminationGracePeriodSeconds: 0
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-exporter.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: postgres-exporter
|
|
name: postgres-exporter
|
|
namespace: keycloak
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: postgres-exporter
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres-exporter
|
|
annotations:
|
|
checksum: ea6be7f450cc15ae55e469caf5a789a1cfd67ff8612d737ec5d85c83d528ee52
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: DATA_SOURCE_NAME
|
|
value: postgresql://keycloak:secret99@postgres:5432/keycloak?sslmode=disable
|
|
- name: PG_EXPORTER_EXTEND_QUERY_PATH
|
|
value: /conf/pgexporter-queries.yaml
|
|
image: quay.io/prometheuscommunity/postgres-exporter:v0.10.1
|
|
imagePullPolicy: Always
|
|
startupProbe:
|
|
httpGet:
|
|
path: /metrics
|
|
port: 9187
|
|
failureThreshold: 20
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 2
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /metrics
|
|
port: 9187
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /metrics
|
|
port: 9187
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
name: postgres-exporter
|
|
ports:
|
|
- containerPort: 9187
|
|
name: metrics
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- mountPath: /conf
|
|
name: config
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: postgres-exporter
|
|
---
|
|
# Source: keycloak/templates/sqlpad.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: sqlpad
|
|
name: sqlpad
|
|
namespace: keycloak
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: sqlpad
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: sqlpad
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: SQLPAD_ADMIN
|
|
value: 'admin'
|
|
- name: SQLPAD_ADMIN_PASSWORD
|
|
value: 'admin'
|
|
- name: SQLPAD_PORT
|
|
value: '3000'
|
|
- name: SQLPAD_APP_LOG_LEVEL
|
|
value: debug
|
|
- name: SQLPAD_WEB_LOG_LEVEL
|
|
value: warn
|
|
- name: SQLPAD_SEED_DATA_PATH
|
|
value: /etc/sqlpad/seed-data
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__name
|
|
value: PostgresSQL Keycloak
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__port
|
|
value: '5432'
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__host
|
|
value: postgres
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__username
|
|
value: keycloak
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__password
|
|
value: pass
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__database
|
|
value: keycloak
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__driver
|
|
value: postgres
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__multiStatementTransactionEnabled
|
|
value: 'true'
|
|
- name: SQLPAD_CONNECTIONS__pgdemo__idleTimeoutSeconds
|
|
value: '86400'
|
|
- name: SQLPAD_QUERY_RESULT_MAX_ROWS
|
|
value: '100000'
|
|
image: sqlpad/sqlpad:6.11.0
|
|
imagePullPolicy: Always
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
failureThreshold: 20
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 2
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
failureThreshold: 10
|
|
periodSeconds: 10
|
|
name: sqlpad
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
restartPolicy: Always
|
|
---
|
|
# Source: keycloak/templates/sqlpad.yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
labels:
|
|
app: sqlpad
|
|
name: sqlpad
|
|
namespace: keycloak
|
|
spec:
|
|
defaultBackend:
|
|
service:
|
|
name: sqlpad
|
|
port:
|
|
number: 3000
|
|
rules:
|
|
- host: sqlpad.minikube.nip.io
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: sqlpad
|
|
port:
|
|
number: 3000
|
|
path: /
|
|
pathType: ImplementationSpecific
|
|
---
|
|
# Source: keycloak/templates/keycloak.yaml
|
|
# There are several callouts in this YAML marked with `# <1>' etc. See 'running/keycloak-deployment.adoc` for the details.
|
|
# tag::keycloak[]
|
|
# tag::keycloak-ispn[]
|
|
apiVersion: k8s.keycloak.org/v2alpha1
|
|
kind: Keycloak
|
|
metadata:
|
|
labels:
|
|
app: keycloak
|
|
name: keycloak
|
|
namespace: keycloak
|
|
spec:
|
|
# end::keycloak-ispn[]
|
|
hostname:
|
|
hostname: <KEYCLOAK_URL_HERE>
|
|
resources:
|
|
requests:
|
|
memory: "1024M"
|
|
limits:
|
|
memory: "1024M"
|
|
db:
|
|
vendor: postgres
|
|
url: jdbc:aws-wrapper:postgresql://<AWS_AURORA_URL_HERE>:5432/keycloak
|
|
poolMinSize: 15 # <1>
|
|
poolInitialSize: 15
|
|
poolMaxSize: 15
|
|
usernameSecret:
|
|
name: keycloak-db-secret
|
|
key: username
|
|
passwordSecret:
|
|
name: keycloak-db-secret
|
|
key: password
|
|
image: <KEYCLOAK_IMAGE_HERE> # <2>
|
|
startOptimized: false # <2>
|
|
features:
|
|
enabled:
|
|
- multi-site # <3>
|
|
# tag::keycloak-ispn[]
|
|
cache:
|
|
configMapFile:
|
|
name: kcb-infinispan-cache-config # <1>
|
|
key: kcb-infinispan-cache-remote-store-config.xml # <1>
|
|
# end::keycloak-ispn[]
|
|
transaction:
|
|
xaEnabled: false # <4>
|
|
# tag::keycloak-ispn[]
|
|
additionalOptions:
|
|
# end::keycloak-ispn[]
|
|
# tag::keycloak-queue-size[]
|
|
- name: http-max-queued-requests
|
|
value: "1000"
|
|
# end::keycloak-queue-size[]
|
|
- name: log-console-output
|
|
value: json
|
|
- name: metrics-enabled # <5>
|
|
value: 'true'
|
|
- name: http-pool-max-threads # <6>
|
|
value: "200"
|
|
# tag::keycloak-ispn[]
|
|
- name: remote-store-host # <2>
|
|
value: "infinispan.keycloak.svc"
|
|
- name: remote-store-port # <2>
|
|
value: "11222"
|
|
- name: remote-store-username # <3>
|
|
secret:
|
|
name: remote-store-secret
|
|
key: username
|
|
- name: remote-store-password # <3>
|
|
secret:
|
|
name: remote-store-secret
|
|
key: password
|
|
- name: spi-connections-infinispan-quarkus-site-name # <4>
|
|
value: keycloak
|
|
# end::keycloak-ispn[]
|
|
- name: db-driver
|
|
value: software.amazon.jdbc.Driver
|
|
http:
|
|
tlsSecret: keycloak-tls-secret
|
|
instances: 1
|
|
# end::keycloak[]
|
|
unsupported:
|
|
podTemplate:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: ebe9b8c121995f449a1a4e339af244b2bb67769af84b3cbdff61159948447e20-4832924b47210161956e3b1718daf07ff52d801545186a76c391485eaf1897d3-<KEYCLOAK_IMAGE_HERE>-dbc855dd9b7f7c0b828760ea8cd7427e8a2f5a5be303fba7dee0c6bbb68258d4-v1.27.0
|
|
spec:
|
|
containers:
|
|
- env:
|
|
# We want to have an externally provided username and password, therefore, we override those two environment variables
|
|
- name: KEYCLOAK_ADMIN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-preconfigured-admin
|
|
key: username
|
|
optional: false
|
|
- name: KEYCLOAK_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-preconfigured-admin
|
|
key: password
|
|
optional: false
|
|
- name: JAVA_OPTS_APPEND # <5>
|
|
value: ""
|
|
ports:
|
|
# end::keycloak[]
|
|
# readinessProbe:
|
|
# exec:
|
|
# command:
|
|
# - 'true'
|
|
# livenessProbe:
|
|
# exec:
|
|
# command:
|
|
# - 'true'
|
|
volumeMounts:
|
|
- name: keycloak-providers
|
|
mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-0.12-SNAPSHOT.jar
|
|
subPath: keycloak-benchmark-dataset-0.12-SNAPSHOT.jar
|
|
readOnly: true
|
|
volumes:
|
|
- name: keycloak-providers
|
|
configMap:
|
|
name: keycloak-providers
|
|
---
|
|
# Source: keycloak/templates/keycloak-monitor.yaml
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: PodMonitor
|
|
metadata:
|
|
name: keycloak-metrics
|
|
namespace: keycloak
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: keycloak
|
|
podMetricsEndpoints:
|
|
# todo: targetPort is deprecated, ask the operator to specify a name instead
|
|
- targetPort: 8443
|
|
scheme: https
|
|
tlsConfig:
|
|
insecureSkipVerify: true
|
|
---
|
|
# Source: keycloak/templates/postgres/postgres-exporter.yaml
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
labels:
|
|
app: postgres-exporter
|
|
name: postgres-exporter
|
|
namespace: keycloak
|
|
spec:
|
|
endpoints:
|
|
- port: metrics
|
|
jobLabel: jobLabel
|
|
selector:
|
|
matchLabels:
|
|
app: postgres-exporter
|