jakman85andClaude Opus 4.8
eccc13bb3c
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
36 lines
1.6 KiB
YAML
36 lines
1.6 KiB
YAML
# ServiceDefinition: keycloak
|
|
# Source of truth: spec docs/13-service-catalog.md row 0; docs/15-identity-and-access.md; ADR-0014.
|
|
# public IdP | egress internet | PostgreSQL on Longhorn (irreplaceable, DR-critical) | auth native.
|
|
# Keycloak IS the IdP (root of trust): its own admin login is local + MFA, so it does not federate.
|
|
# Validates against schemas/servicedefinition.schema.json.
|
|
name: keycloak
|
|
kind: container
|
|
source:
|
|
image: quay.io/keycloak/keycloak
|
|
exposure: public # login/redirect flows for internet-exposed services; hardened (docs/15; R-DNS/R-NET)
|
|
egress: internet # normal WAN egress (docs/03; R-NET-05)
|
|
storage:
|
|
- name: db
|
|
size: 10Gi
|
|
class: longhorn # PostgreSQL on 3-replica Longhorn; irreplaceable (docs/15, docs/04; R-STATE-02)
|
|
dependencies:
|
|
- to: keycloak-db # explicit allow: Keycloak -> its PostgreSQL (docs/13 graph; R-NET-02)
|
|
port: 5432
|
|
protocol: tcp
|
|
ingressRoutes:
|
|
- host: keycloak.home.keithjackson.dev
|
|
port: 8080 # HTTP listener; TLS terminates at the Gateway (docs/08, docs/09)
|
|
auth:
|
|
mode: native # it IS the IdP; own admin login is local + MFA (docs/15; ADR-0014). Documented exception.
|
|
update:
|
|
channel: stable # R-UPD-01
|
|
range: ">=24.0.0"
|
|
cadence: "0 4 * * *"
|
|
autoRollbackOnFailedHealth: true # R-UPD-03
|
|
observability:
|
|
metrics: true
|
|
slis:
|
|
- up # IdP down/unhealthy is a critical alert (docs/10; R-OBS-01)
|
|
backup:
|
|
policy: daily-offcluster # DR-critical: rebuilds from DB + git realm config (docs/15, docs/04; R-STATE-03)
|