libre.sh/keycloak-scim
2
0
Fork 0
Code Issues 14 Pull requests Releases Packages Activity Actions 6
keycloak-scim/docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
Ryan Emerson a32808e8eb
Upgrade to Infinispan 14.0.26.Final 
Closes #27871

Signed-off-by: Ryan Emerson <remerson@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2024-03-13 17:24:20 +00:00

863 lines
31 KiB
YAML
Raw Blame History

---
# Source: keycloak/templates/infinispan/remote-store-secret.yaml
# tag::keycloak-ispn-secret[]
apiVersion: v1
kind: Secret
metadata:
name: remote-store-secret
namespace: keycloak
type: Opaque
data:
username: ZGV2ZWxvcGVy # base64 encoding for 'developer'
password: c2VjdXJlX3Bhc3N3b3Jk # base64 encoding for 'secure_password'
# end::keycloak-ispn-secret[]
---
# Source: keycloak/templates/keycloak-db-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: keycloak-db-secret
namespace: keycloak
type: Opaque
data:
username: a2V5Y2xvYWs= # keycloak
password: c2VjcmV0OTk= # secret99
---
# Source: keycloak/templates/keycloak-initial-admin-secret.yaml
apiVersion: v1
kind: Secret
metadata:
labels:
app: keycloak
name: keycloak-preconfigured-admin
namespace: keycloak
type: kubernetes.io/basic-auth
data:
password: YWRtaW4= # admin by default
username: YWRtaW4= # admin
---
# Source: keycloak/templates/keycloak-tls-secret.yaml
apiVersion: v1
data:
tls.crt: ...
tls.key: ...
kind: Secret
metadata:
name: keycloak-tls-secret
namespace: keycloak
type: kubernetes.io/tls
---
# Source: keycloak/templates/keycloak-infinispan-configmap.yaml
# tag::keycloak-ispn-configmap[]
apiVersion: v1
kind: ConfigMap
metadata:
name: kcb-infinispan-cache-config
namespace: keycloak
data:
kcb-infinispan-cache-remote-store-config.xml: |
<?xml version="1.0" encoding="UTF-8"?>
<!-- end::keycloak-ispn-configmap[] -->
<!--
~ Copyright 2019 Red Hat, Inc. and/or its affiliates
~ and other contributors as indicated by the @author tags.
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
-->
<!--tag::keycloak-ispn-configmap[] -->
<infinispan
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:infinispan:config:14.0 https://www.infinispan.org/schemas/infinispan-config-14.0.xsd
urn:infinispan:config:store:remote:14.0 https://www.infinispan.org/schemas/infinispan-cachestore-remote-config-14.0.xsd"
xmlns="urn:infinispan:config:14.0">
<!--end::keycloak-ispn-configmap[] -->
<!-- the statistics="true" attribute is not part of the original KC config and was added by Keycloak Benchmark -->
<cache-container name="keycloak" statistics="true">
<transport lock-timeout="60000"/>
<metrics names-as-tags="true" />
<local-cache name="realms" simple-cache="true" statistics="true">
<encoding>
<key media-type="application/x-java-object"/>
<value media-type="application/x-java-object"/>
</encoding>
<memory max-count="10000"/>
</local-cache>
<local-cache name="users" simple-cache="true" statistics="true">
<encoding>
<key media-type="application/x-java-object"/>
<value media-type="application/x-java-object"/>
</encoding>
<memory max-count="10000"/>
</local-cache>
<!--tag::keycloak-ispn-remotestore[] -->
<distributed-cache name="sessions" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false"> <!--1-->
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="sessions"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/> <!--2-->
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/> <!--3-->
</authentication>
<encryption protocol="TLSv1.3"
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/> <!--4-->
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<!--end::keycloak-ispn-remotestore[] -->
<distributed-cache name="authenticationSessions" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="authenticationSessions"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3"
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<distributed-cache name="offlineSessions" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="offlineSessions"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3"
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<distributed-cache name="clientSessions" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="clientSessions"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<distributed-cache name="offlineClientSessions" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="offlineClientSessions"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<distributed-cache name="loginFailures" owners="2" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="loginFailures"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
<local-cache name="authorization" simple-cache="true" statistics="true">
<encoding>
<key media-type="application/x-java-object"/>
<value media-type="application/x-java-object"/>
</encoding>
<memory max-count="10000"/>
</local-cache>
<!--tag::keycloak-ispn-remotestore-work[] -->
<replicated-cache name="work" statistics="true">
<expiration lifespan="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="work"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</replicated-cache>
<!--end::keycloak-ispn-remotestore-work[] -->
<local-cache name="keys" simple-cache="true" statistics="true">
<encoding>
<key media-type="application/x-java-object"/>
<value media-type="application/x-java-object"/>
</encoding>
<expiration max-idle="3600000"/>
<memory max-count="1000"/>
</local-cache>
<distributed-cache name="actionTokens" owners="2" statistics="true">
<encoding>
<key media-type="application/x-java-object"/>
<value media-type="application/x-java-object"/>
</encoding>
<expiration max-idle="-1" lifespan="-1" interval="300000"/>
<memory max-count="-1"/>
<persistence passivation="false">
<remote-store xmlns="urn:infinispan:config:store:remote:14.0"
cache="actionTokens"
raw-values="true"
shared="true"
segmented="false">
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/>
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/>
</authentication>
<encryption protocol="TLSv1.3" sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/>
</encryption>
</security>
</remote-store>
</persistence>
</distributed-cache>
</cache-container>
</infinispan>
---
# Source: keycloak/templates/keycloak-providers-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: keycloak-providers
namespace: keycloak
binaryData:
keycloak-benchmark-dataset-0.12-SNAPSHOT.jar: ...
---
# Source: keycloak/templates/postgres/postgres-exporter-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: postgres-exporter
namespace: keycloak
data:
pgexporter-queries.yaml: |
# This is configuration file for postgres_exporter.
# Add custom metrics via SQL statements here as described here: https://github.com/prometheus-community/postgres_exporter#adding-new-metrics-via-a-config-file
# See https://github.com/prometheus-community/postgres_exporter/blob/master/queries.yaml for examples.
pg_locks_waiting:
# language=SQL
query: |
WITH q_locks AS (select * from pg_locks where granted = false and pid != pg_backend_pid())
SELECT (select current_database()) as datname, lower(lockmodes) AS mode, coalesce((select count(*) FROM q_locks WHERE mode = lockmodes), 0) AS count FROM
unnest('{AccessShareLock, ExclusiveLock, RowShareLock, RowExclusiveLock, ShareLock, ShareRowExclusiveLock, AccessExclusiveLock, ShareUpdateExclusiveLock}'::text[]) lockmodes;
metrics:
- datname:
usage: "LABEL"
description: "Database name"
- mode:
usage: "LABEL"
description: "Lock type"
- count:
usage: "GAUGE"
description: "Number of locks"
---
# Source: keycloak/templates/keycloak-jvmdebug-service.yaml
apiVersion: v1
kind: Service
metadata:
labels:
app: keycloak
name: keycloak-jvmdebug
namespace: keycloak
spec:
type: NodePort
ports:
- name: jvmdebug
port: 8787
protocol: TCP
nodePort: 30012
selector:
app: keycloak
sessionAffinity: None
---
# Source: keycloak/templates/postgres/postgres-exporter.yaml
apiVersion: v1
kind: Service
metadata:
labels:
app: postgres-exporter
name: postgres-exporter
namespace: keycloak
spec:
ports:
- port: 9187
name: metrics
protocol: TCP
targetPort: 9187
selector:
app: postgres-exporter
sessionAffinity: None
type: ClusterIP
---
# Source: keycloak/templates/postgres/postgres-nodeport.yaml
apiVersion: v1
kind: Service
metadata:
name: postgres-nodeport
namespace: keycloak
labels:
app: postgres
spec:
type: NodePort
ports:
- protocol: TCP
port: 5432
nodePort: 30009
selector:
app: postgres
---
# Source: keycloak/templates/postgres/postgres-service.yaml
apiVersion: v1
kind: Service
metadata:
labels:
app: postgres
name: postgres
namespace: keycloak
spec:
ports:
- port: 5432
protocol: TCP
targetPort: 5432
selector:
app: postgres
sessionAffinity: None
type: ClusterIP
---
# Source: keycloak/templates/sqlpad.yaml
apiVersion: v1
kind: Service
metadata:
labels:
app: sqlpad
name: sqlpad
namespace: keycloak
spec:
ports:
- port: 3000
protocol: TCP
targetPort: 3000
selector:
app: sqlpad
sessionAffinity: None
type: ClusterIP
---
# Source: keycloak/templates/postgres/postgres-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: postgres
name: postgres
namespace: keycloak
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: postgres
strategy:
type: Recreate
template:
metadata:
labels:
app: postgres
spec:
containers:
- imagePullPolicy: Always
env:
- name: POSTGRES_PASSWORD
value: secret99
- name: POSTGRES_USER
value: keycloak
- name: POSTGRES_DB
value: keycloak
image: postgres:13.2
args:
# default of max_prepared_transactions is 0, and this setting should match the number of active connections
# so that running Quarkus with JTA and more than one data store can prepare transactions.
- -c
- max_prepared_transactions=100
resources:
requests:
cpu: "0"
startupProbe:
tcpSocket:
port: 5432
failureThreshold: 20
initialDelaySeconds: 10
periodSeconds: 2
readinessProbe:
tcpSocket:
port: 5432
failureThreshold: 10
periodSeconds: 10
livenessProbe:
tcpSocket:
port: 5432
failureThreshold: 10
periodSeconds: 10
name: postgres
ports:
- containerPort: 5432
protocol: TCP
restartPolicy: Always
# The rhel9/postgresql-13 is known to take ~30 seconds to shut down
# As this is a deployment with ephemeral storage, there is no need to wait as the data will be gone anyway
terminationGracePeriodSeconds: 0
---
# Source: keycloak/templates/postgres/postgres-exporter.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: postgres-exporter
name: postgres-exporter
namespace: keycloak
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: postgres-exporter
strategy:
type: Recreate
template:
metadata:
labels:
app: postgres-exporter
annotations:
checksum: ea6be7f450cc15ae55e469caf5a789a1cfd67ff8612d737ec5d85c83d528ee52
spec:
containers:
- env:
- name: DATA_SOURCE_NAME
value: postgresql://keycloak:secret99@postgres:5432/keycloak?sslmode=disable
- name: PG_EXPORTER_EXTEND_QUERY_PATH
value: /conf/pgexporter-queries.yaml
image: quay.io/prometheuscommunity/postgres-exporter:v0.10.1
imagePullPolicy: Always
startupProbe:
httpGet:
path: /metrics
port: 9187
failureThreshold: 20
initialDelaySeconds: 10
periodSeconds: 2
readinessProbe:
httpGet:
path: /metrics
port: 9187
failureThreshold: 10
periodSeconds: 10
livenessProbe:
httpGet:
path: /metrics
port: 9187
failureThreshold: 10
periodSeconds: 10
name: postgres-exporter
ports:
- containerPort: 9187
name: metrics
protocol: TCP
volumeMounts:
- mountPath: /conf
name: config
restartPolicy: Always
volumes:
- name: config
configMap:
name: postgres-exporter
---
# Source: keycloak/templates/sqlpad.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: sqlpad
name: sqlpad
namespace: keycloak
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: sqlpad
strategy:
type: Recreate
template:
metadata:
labels:
app: sqlpad
spec:
containers:
- env:
- name: SQLPAD_ADMIN
value: 'admin'
- name: SQLPAD_ADMIN_PASSWORD
value: 'admin'
- name: SQLPAD_PORT
value: '3000'
- name: SQLPAD_APP_LOG_LEVEL
value: debug
- name: SQLPAD_WEB_LOG_LEVEL
value: warn
- name: SQLPAD_SEED_DATA_PATH
value: /etc/sqlpad/seed-data
- name: SQLPAD_CONNECTIONS__pgdemo__name
value: PostgresSQL Keycloak
- name: SQLPAD_CONNECTIONS__pgdemo__port
value: '5432'
- name: SQLPAD_CONNECTIONS__pgdemo__host
value: postgres
- name: SQLPAD_CONNECTIONS__pgdemo__username
value: keycloak
- name: SQLPAD_CONNECTIONS__pgdemo__password
value: pass
- name: SQLPAD_CONNECTIONS__pgdemo__database
value: keycloak
- name: SQLPAD_CONNECTIONS__pgdemo__driver
value: postgres
- name: SQLPAD_CONNECTIONS__pgdemo__multiStatementTransactionEnabled
value: 'true'
- name: SQLPAD_CONNECTIONS__pgdemo__idleTimeoutSeconds
value: '86400'
- name: SQLPAD_QUERY_RESULT_MAX_ROWS
value: '100000'
image: sqlpad/sqlpad:6.11.0
imagePullPolicy: Always
startupProbe:
httpGet:
path: /
port: 3000
failureThreshold: 20
initialDelaySeconds: 10
periodSeconds: 2
readinessProbe:
httpGet:
path: /
port: 3000
failureThreshold: 10
periodSeconds: 10
livenessProbe:
httpGet:
path: /
port: 3000
failureThreshold: 10
periodSeconds: 10
name: sqlpad
ports:
- containerPort: 3000
protocol: TCP
restartPolicy: Always
---
# Source: keycloak/templates/sqlpad.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
labels:
app: sqlpad
name: sqlpad
namespace: keycloak
spec:
defaultBackend:
service:
name: sqlpad
port:
number: 3000
rules:
- host: sqlpad.minikube.nip.io
http:
paths:
- backend:
service:
name: sqlpad
port:
number: 3000
path: /
pathType: ImplementationSpecific
---
# Source: keycloak/templates/keycloak.yaml
# There are several callouts in this YAML marked with `# <1>' etc. See 'running/keycloak-deployment.adoc` for the details.
# tag::keycloak[]
# tag::keycloak-ispn[]
apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
labels:
app: keycloak
name: keycloak
namespace: keycloak
spec:
# end::keycloak-ispn[]
hostname:
hostname: <KEYCLOAK_URL_HERE>
resources:
requests:
memory: "1024M"
limits:
memory: "1024M"
db:
vendor: postgres
url: jdbc:aws-wrapper:postgresql://<AWS_AURORA_URL_HERE>:5432/keycloak
poolMinSize: 15 # <1>
poolInitialSize: 15
poolMaxSize: 15
usernameSecret:
name: keycloak-db-secret
key: username
passwordSecret:
name: keycloak-db-secret
key: password
image: <KEYCLOAK_IMAGE_HERE> # <2>
startOptimized: false # <2>
features:
enabled:
- multi-site # <3>
# tag::keycloak-ispn[]
cache:
configMapFile:
name: kcb-infinispan-cache-config # <1>
key: kcb-infinispan-cache-remote-store-config.xml # <1>
# end::keycloak-ispn[]
transaction:
xaEnabled: false # <4>
# tag::keycloak-ispn[]
additionalOptions:
# end::keycloak-ispn[]
# tag::keycloak-queue-size[]
- name: http-max-queued-requests
value: "1000"
# end::keycloak-queue-size[]
- name: log-console-output
value: json
- name: metrics-enabled # <5>
value: 'true'
- name: http-pool-max-threads # <6>
value: "200"
# tag::keycloak-ispn[]
- name: remote-store-host # <2>
value: "infinispan.keycloak.svc"
- name: remote-store-port # <2>
value: "11222"
- name: remote-store-username # <3>
secret:
name: remote-store-secret
key: username
- name: remote-store-password # <3>
secret:
name: remote-store-secret
key: password
- name: spi-connections-infinispan-quarkus-site-name # <4>
value: keycloak
# end::keycloak-ispn[]
- name: db-driver
value: software.amazon.jdbc.Driver
http:
tlsSecret: keycloak-tls-secret
instances: 1
# end::keycloak[]
unsupported:
podTemplate:
metadata:
annotations:
checksum/config: ebe9b8c121995f449a1a4e339af244b2bb67769af84b3cbdff61159948447e20-4832924b47210161956e3b1718daf07ff52d801545186a76c391485eaf1897d3-<KEYCLOAK_IMAGE_HERE>-dbc855dd9b7f7c0b828760ea8cd7427e8a2f5a5be303fba7dee0c6bbb68258d4-v1.27.0
spec:
containers:
- env:
# We want to have an externally provided username and password, therefore, we override those two environment variables
- name: KEYCLOAK_ADMIN
valueFrom:
secretKeyRef:
name: keycloak-preconfigured-admin
key: username
optional: false
- name: KEYCLOAK_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: keycloak-preconfigured-admin
key: password
optional: false
- name: JAVA_OPTS_APPEND # <5>
value: ""
ports:
# end::keycloak[]
# readinessProbe:
# exec:
# command:
# - 'true'
# livenessProbe:
# exec:
# command:
# - 'true'
volumeMounts:
- name: keycloak-providers
mountPath: /opt/keycloak/providers/keycloak-benchmark-dataset-0.12-SNAPSHOT.jar
subPath: keycloak-benchmark-dataset-0.12-SNAPSHOT.jar
readOnly: true
volumes:
- name: keycloak-providers
configMap:
name: keycloak-providers
---
# Source: keycloak/templates/keycloak-monitor.yaml
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: keycloak-metrics
namespace: keycloak
spec:
selector:
matchLabels:
app: keycloak
podMetricsEndpoints:
# todo: targetPort is deprecated, ask the operator to specify a name instead
- targetPort: 8443
scheme: https
tlsConfig:
insecureSkipVerify: true
---
# Source: keycloak/templates/postgres/postgres-exporter.yaml
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
labels:
app: postgres-exporter
name: postgres-exporter
namespace: keycloak
spec:
endpoints:
- port: metrics
jobLabel: jobLabel
selector:
matchLabels:
app: postgres-exporter
Reference in a new issue View git blame Copy permalink