76 lines
3.2 KiB
YAML
76 lines
3.2 KiB
YAML
---
|
|
# Keycloak instance (CR of the Operator CRD installed by platform/keycloak). CARRIED BY
|
|
# platform-config (dependsOn platform) — F-MON1 controllers/configs split.
|
|
#
|
|
# Served behind the shared Gateway at keycloak.home.keithjackson.dev (public, hardened): TLS is
|
|
# terminated by the Gateway wildcard cert, so Keycloak runs HTTP internally + trusts X-Forwarded-*
|
|
# (production/proxy-aware, docs/15). Admin (break-glass) credential comes from the SOPS-encrypted
|
|
# keycloak-admin-credentials Secret; realm/clients/groups are reconciled by the KeycloakRealmImport.
|
|
apiVersion: k8s.keycloak.org/v2alpha1
|
|
kind: Keycloak
|
|
metadata:
|
|
name: keycloak
|
|
namespace: keycloak
|
|
spec:
|
|
instances: ${KEYCLOAK_REPLICAS} # overlay knob (dev 1 / prod 2 HA) — R-ENV-02
|
|
# --- Database: CloudNativePG cluster (platform/keycloak/postgres-cluster.yaml). The read-write
|
|
# service keycloak-db-rw + the CNPG-generated keycloak-db-app secret (keys username/password). ---
|
|
db:
|
|
vendor: postgres
|
|
host: keycloak-db-rw
|
|
port: 5432
|
|
database: keycloak
|
|
usernameSecret:
|
|
name: keycloak-db-app
|
|
key: username
|
|
passwordSecret:
|
|
name: keycloak-db-app
|
|
key: password
|
|
poolMinSize: 5
|
|
poolMaxSize: 20
|
|
# --- Exposure: TLS at the Gateway; Keycloak serves HTTP and trusts the proxy headers. ---
|
|
hostname:
|
|
hostname: https://keycloak.home.keithjackson.dev
|
|
http:
|
|
httpEnabled: true # TLS is terminated at the Gateway (edge), not in Keycloak
|
|
proxy:
|
|
headers: xforwarded # trust X-Forwarded-* from the shared Gateway
|
|
ingress:
|
|
enabled: false # exposed via Gateway API HTTPRoute (httproute.yaml), not the
|
|
# operator's built-in Ingress
|
|
# --- Hardening + observability options (docs/15). Brute-force detection is a REALM setting
|
|
# (bruteForceProtected in the realm import); these enable health + metrics endpoints. ---
|
|
additionalOptions:
|
|
- name: metrics-enabled
|
|
value: "true"
|
|
- name: health-enabled
|
|
value: "true"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 768Mi
|
|
limits:
|
|
memory: 1280Mi
|
|
# --- Admin bootstrap credential (R-IDP-04, break-glass R-IDP-05) ---
|
|
# The provisioned SOPS secret keycloak-admin-credentials carries keys admin-user/admin-password.
|
|
# The operator's supported spec.bootstrapAdmin.user.secret expects keys username/password, so — to
|
|
# consume the already-provisioned secret WITHOUT re-keying it (must not touch its encrypted data) —
|
|
# the credential is injected via the podTemplate escape hatch as KC_BOOTSTRAP_ADMIN_* env, which
|
|
# Keycloak reads to create the temporary bootstrap/break-glass admin on first start.
|
|
unsupported:
|
|
podTemplate:
|
|
spec:
|
|
containers:
|
|
- name: keycloak
|
|
env:
|
|
- name: KC_BOOTSTRAP_ADMIN_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-admin-credentials
|
|
key: admin-user
|
|
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: keycloak-admin-credentials
|
|
key: admin-password
|