jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
---
|
|
# Keycloak — platform IdP (OIDC + SAML), config-as-code, PostgreSQL on Longhorn (ADR-0014).
|
|
# Phase 0 STUB. DR-CRITICAL: DB backed up off-cluster; documented break-glass local-admin path.
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: keycloak
|
|
namespace: keycloak
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: keycloak
|
|
version: ">=24.0.0 <25.0.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: bitnami
|
|
namespace: keycloak
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: ${KEYCLOAK_REPLICAS} # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
|
|
production: true # TLS/proxy-aware; served behind the Gateway (public)
|
|
proxyHeaders: xforwarded
|
|
# PostgreSQL on Longhorn (ADR-0014) — DR-critical, backed up off-cluster (velero/).
|
|
postgresql:
|
|
enabled: true
|
|
primary:
|
|
persistence:
|
|
storageClass: longhorn
|
|
# Admin + DB credentials: SOPS-encrypted secrets referenced BY NAME only (WS-SEC, ADR-0007).
|
|
auth:
|
|
existingSecret: keycloak-admin-credentials
|
|
# TODO(WS-SEC, Phase 6): realms/clients/groups as code (keycloak-config-cli / realm-import);
|
|
# MFA for privileged groups; break-glass local-admin path (e.g. on Gitea). Onboarded EARLY
|
|
# (with PiHole/Gitea) so later services adopt SSO as they come up (roadmap Phase 6).
|