---
# Keycloak instance (CR of the Operator CRD installed by platform/keycloak). CARRIED BY
# platform-config (dependsOn platform) — F-MON1 controllers/configs split.
#
# Served behind the shared Gateway at keycloak.home.keithjackson.dev (public, hardened): TLS is
# terminated by the Gateway wildcard cert, so Keycloak runs HTTP internally + trusts X-Forwarded-*
# (production/proxy-aware, docs/15). Admin (break-glass) credential comes from the SOPS-encrypted
# keycloak-admin-credentials Secret; realm/clients/groups are reconciled by the KeycloakRealmImport.
apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: keycloak
  namespace: keycloak
spec:
  instances: ${KEYCLOAK_REPLICAS}          # overlay knob (dev 1 / prod 2 HA) — R-ENV-02
  # --- Database: CloudNativePG cluster (platform/keycloak/postgres-cluster.yaml). The read-write
  #     service keycloak-db-rw + the CNPG-generated keycloak-db-app secret (keys username/password). ---
  db:
    vendor: postgres
    host: keycloak-db-rw
    port: 5432
    database: keycloak
    usernameSecret:
      name: keycloak-db-app
      key: username
    passwordSecret:
      name: keycloak-db-app
      key: password
    poolMinSize: 5
    poolMaxSize: 20
  # --- Exposure: TLS at the Gateway; Keycloak serves HTTP and trusts the proxy headers. ---
  hostname:
    hostname: https://keycloak.${BASE_DOMAIN}
  http:
    httpEnabled: true                      # TLS is terminated at the Gateway (edge), not in Keycloak
  proxy:
    headers: xforwarded                    # trust X-Forwarded-* from the shared Gateway
  ingress:
    enabled: false                         # exposed via Gateway API HTTPRoute (httproute.yaml), not the
                                           # operator's built-in Ingress
  # --- Hardening + observability options (docs/15). Brute-force detection is a REALM setting
  #     (bruteForceProtected in the realm import); these enable health + metrics endpoints. ---
  additionalOptions:
    - name: metrics-enabled
      value: "true"
    - name: health-enabled
      value: "true"
  resources:
    requests:
      cpu: 250m
      memory: 768Mi
    limits:
      memory: 1280Mi
  # --- Admin bootstrap credential (R-IDP-04, break-glass R-IDP-05) ---
  # The provisioned SOPS secret keycloak-admin-credentials carries keys admin-user/admin-password.
  # The operator's supported spec.bootstrapAdmin.user.secret expects keys username/password, so — to
  # consume the already-provisioned secret WITHOUT re-keying it (must not touch its encrypted data) —
  # the credential is injected via the podTemplate escape hatch as KC_BOOTSTRAP_ADMIN_* env, which
  # Keycloak reads to create the temporary bootstrap/break-glass admin on first start.
  unsupported:
    podTemplate:
      spec:
        containers:
          - name: keycloak
            env:
              - name: KC_BOOTSTRAP_ADMIN_USERNAME
                valueFrom:
                  secretKeyRef:
                    name: keycloak-admin-credentials
                    key: admin-user
              - name: KC_BOOTSTRAP_ADMIN_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: keycloak-admin-credentials
                    key: admin-password