Add support for automated TLS certificates in Keycloak
This update introduces significant enhancements to the Keycloak chart, particularly regarding TLS certificate management. The changes include: - Added the capability to automatically generate and manage TLS certificates using Cert-Manager or Helm, improving the security posture by using self-signed certificates in development scenarios. - Implemented a dedicated ConfigMap to hold keycloak-config-cli configurations and ensured that it is integrated with the job for configuration synchronization. - Enhanced the handling of admin ingress settings and TLS secrets, facilitating smoother access and management for multi-host deployments. - Refactored and reorganized sections to improve readability and maintainability of templates, ensuring adherence to best practices in Helm charts. These improvements aim to streamline deployment, enhance security features, and simplify the management of certificates, facilitating easier Kubernetes operations for users.
This commit is contained in:
@@ -10,7 +10,7 @@ APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
Keycloak can be accessed through the following DNS name from within your cluster:
|
||||
|
||||
{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} (port {{ coalesce .Values.service.ports.http .Values.service.port }})
|
||||
{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} (port {{ ternary .Values.service.ports.https .Values.service.ports.http .Values.tls.enabled }})
|
||||
|
||||
To access Keycloak from outside the cluster execute the following commands:
|
||||
|
||||
@@ -22,60 +22,33 @@ To access Keycloak from outside the cluster execute the following commands:
|
||||
echo "Keycloak URL: http{{ if .Values.ingress.tls }}s{{ end }}://{{ (tpl .Values.ingress.hostname .) }}/"
|
||||
echo "$CLUSTER_IP {{ (tpl .Values.ingress.hostname .) }}" | sudo tee -a /etc/hosts
|
||||
|
||||
{{- if .Values.adminIngress.enabled }}
|
||||
The admin area of Keycloak has been configured to point to a different domain ({{ .Values.adminIngress.hostname }}). Please remember to update the `frontendUrl` property of the `{{ .Values.adminRealm | default "master" }}` (or any other) realm for it to work properly (see README for an example) :
|
||||
|
||||
echo "Keycloak admin URL: http{{ if .Values.adminIngress.tls }}s{{ end }}://{{ (tpl .Values.adminIngress.hostname .) }}/"
|
||||
echo "$CLUSTER_IP {{ (tpl .Values.adminIngress.hostname .) }}" | sudo tee -a /etc/hosts
|
||||
{{- end }}
|
||||
|
||||
{{- else }}
|
||||
|
||||
1. Get the Keycloak URL by running these commands:
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export HTTP_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
{{- end }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
|
||||
echo "http://${NODE_IP}:${HTTP_NODE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://${NODE_IP}:${HTTPS_NODE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://${NODE_IP}:${NODE_PORT}/"
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch its status by running 'kubectl get --namespace {{ include "common.names.namespace" . }} svc -w {{ include "common.names.fullname" . }}'
|
||||
|
||||
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- end }}
|
||||
export SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].port}" services {{ include "common.names.fullname" . }})
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
||||
|
||||
echo "http://${SERVICE_IP}:${HTTP_SERVICE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://${SERVICE_IP}:${HTTPS_SERVICE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://${SERVICE_IP}:${SERVICE_PORT}/"
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} ${HTTPS_SERVICE_PORT}:${HTTPS_SERVICE_PORT} &
|
||||
{{- else }}
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} &
|
||||
{{- end }}
|
||||
export SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].port}" services {{ include "common.names.fullname" . }})
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${SERVICE_PORT}:${SERVICE_PORT} &
|
||||
|
||||
echo "http://127.0.0.1:${HTTP_SERVICE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://127.0.0.1:${HTTPS_SERVICE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://127.0.0.1:${SERVICE_PORT}/"
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -85,7 +58,7 @@ The admin area of Keycloak has been configured to point to a different domain ({
|
||||
3. Access the Administration Console using the following credentials:
|
||||
|
||||
echo Username: {{ .Values.auth.adminUser }}
|
||||
echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keycloak.secretName" . }} -o jsonpath="{.data.{{ include "keycloak.secretKey" .}}}" | base64 -d)
|
||||
echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keycloak.secretName" . }} -o jsonpath="{.data.{{ include "keycloak.secretKey" . }}}" | base64 -d)
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
|
||||
@@ -93,9 +66,9 @@ You can access the Prometheus metrics following the steps below:
|
||||
|
||||
1. Get the Keycloak Prometheus metrics URL by running:
|
||||
|
||||
{{- $metricsPort := coalesce .Values.metrics.service.ports.metrics .Values.metrics.service.port | toString }}
|
||||
{{- $metricsPort := .Values.metrics.service.ports.metrics | toString }}
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ printf "%s-metrics" (include "common.names.fullname" .) }} {{ $metricsPort }}:{{ $metricsPort }} &
|
||||
echo "Keycloak Prometheus metrics URL: http://127.0.0.1:{{ $metricsPort }}/metrics"
|
||||
echo "Keycloak Prometheus metrics URL: http{{ if .Values.tls.enabled }}s{{ end }}://127.0.0.1:{{ $metricsPort }}/metrics"
|
||||
|
||||
2. Open a browser and access Keycloak Prometheus metrics using the obtained URL.
|
||||
|
||||
@@ -104,6 +77,6 @@ You can access the Prometheus metrics following the steps below:
|
||||
{{- include "keycloak.validateValues" . }}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.keycloakConfigCli.image }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "keycloakConfigCli" "") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "" "keycloakConfigCli") "context" .) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" .) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" .) }}
|
||||
|
||||
@@ -17,39 +17,35 @@ Return the proper keycloak-config-cli image name
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.keycloakConfigCli.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the keycloak-config-cli configuration configmap.
|
||||
*/}}
|
||||
{{- define "keycloak.keycloakConfigCli.configmapName" -}}
|
||||
{{- if .Values.keycloakConfigCli.existingConfigmap -}}
|
||||
{{- printf "%s" (tpl .Values.keycloakConfigCli.existingConfigmap $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-keycloak-config-cli-configmap" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a configmap object should be created for keycloak-config-cli
|
||||
*/}}
|
||||
{{- define "keycloak.keycloakConfigCli.createConfigmap" -}}
|
||||
{{- if and .Values.keycloakConfigCli.enabled .Values.keycloakConfigCli.configuration (not .Values.keycloakConfigCli.existingConfigmap) -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "keycloak.imagePullSecrets" -}}
|
||||
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) -}}
|
||||
{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
Create a default fully qualified postgresql name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "keycloak.postgresql.fullname" -}}
|
||||
{{- include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" $) -}}
|
||||
{{- include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified headless service name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "keycloak.headless.serviceName" -}}
|
||||
{{- printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified headless service name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "keycloak.headless.ispn.serviceName" -}}
|
||||
{{- printf "%s-headless-ispn-%s" (include "common.names.fullname" .) (replace "." "-" .Chart.AppVersion) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
@@ -64,189 +60,24 @@ Create the name of the service account to use
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the path Keycloak is hosted on. This looks at httpRelativePath and returns it with a trailing slash. For example:
|
||||
/ -> / (the default httpRelativePath)
|
||||
/auth -> /auth/ (trailing slash added)
|
||||
/custom/ -> /custom/ (unchanged)
|
||||
*/}}
|
||||
{{- define "keycloak.httpPath" -}}
|
||||
{{ ternary .Values.httpRelativePath (printf "%s%s" .Values.httpRelativePath "/") (hasSuffix "/" .Values.httpRelativePath) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Keycloak configuration configmap
|
||||
Return the Keycloak configuration ConfigMap name.
|
||||
*/}}
|
||||
{{- define "keycloak.configmapName" -}}
|
||||
{{- if .Values.existingConfigmap -}}
|
||||
{{- printf "%s" (tpl .Values.existingConfigmap $) -}}
|
||||
{{- tpl .Values.existingConfigmap . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-configuration" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a configmap object should be created
|
||||
*/}}
|
||||
{{- define "keycloak.createConfigmap" -}}
|
||||
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database hostname
|
||||
*/}}
|
||||
{{- define "keycloak.databaseHost" -}}
|
||||
{{- if eq .Values.postgresql.architecture "replication" }}
|
||||
{{- ternary (include "keycloak.postgresql.fullname" .) (tpl .Values.externalDatabase.host $) .Values.postgresql.enabled -}}-primary
|
||||
{{- else -}}
|
||||
{{- ternary (include "keycloak.postgresql.fullname" .) (tpl .Values.externalDatabase.host $) .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database port
|
||||
*/}}
|
||||
{{- define "keycloak.databasePort" -}}
|
||||
{{- ternary "5432" (tpl (.Values.externalDatabase.port | toString) $) .Values.postgresql.enabled | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database database name
|
||||
*/}}
|
||||
{{- define "keycloak.databaseName" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- if .Values.global.postgresql }}
|
||||
{{- if .Values.global.postgresql.auth }}
|
||||
{{- coalesce .Values.global.postgresql.auth.database .Values.postgresql.auth.database -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.auth.database -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.auth.database -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- tpl .Values.externalDatabase.database $ -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database port
|
||||
*/}}
|
||||
{{- define "keycloak.databaseSchema" -}}
|
||||
{{- ternary "public" (tpl (.Values.externalDatabase.schema | toString) $) .Values.postgresql.enabled | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database user
|
||||
*/}}
|
||||
{{- define "keycloak.databaseUser" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.auth -}}
|
||||
{{- coalesce .Values.global.postgresql.auth.username .Values.postgresql.auth.username -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.auth.username -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- .Values.postgresql.auth.username -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- tpl .Values.externalDatabase.user $ -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database encrypted password
|
||||
*/}}
|
||||
{{- define "keycloak.databaseSecretName" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if .Values.global.postgresql -}}
|
||||
{{- if .Values.global.postgresql.auth -}}
|
||||
{{- if .Values.global.postgresql.auth.existingSecret -}}
|
||||
{{- tpl .Values.global.postgresql.auth.existingSecret $ -}}
|
||||
{{- else -}}
|
||||
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- default (include "keycloak.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- default (printf "%s-externaldb" (include "common.names.fullname" .)) (tpl .Values.externalDatabase.existingSecret $) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Add environment variables to configure database values
|
||||
*/}}
|
||||
{{- define "keycloak.databaseSecretPasswordKey" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- printf "%s" (.Values.postgresql.auth.secretKeys.userPasswordKey | default "password") -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.externalDatabase.existingSecret -}}
|
||||
{{- if .Values.externalDatabase.existingSecretPasswordKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretPasswordKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-password" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- print "db-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "keycloak.databaseSecretHostKey" -}}
|
||||
{{- if .Values.externalDatabase.existingSecretHostKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretHostKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-host" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- define "keycloak.databaseSecretPortKey" -}}
|
||||
{{- if .Values.externalDatabase.existingSecretPortKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretPortKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-port" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- define "keycloak.databaseSecretUserKey" -}}
|
||||
{{- if .Values.externalDatabase.existingSecretUserKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretUserKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-user" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- define "keycloak.databaseSecretDatabaseKey" -}}
|
||||
{{- if .Values.externalDatabase.existingSecretDatabaseKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretDatabaseKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-database" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Keycloak initdb scripts configmap
|
||||
*/}}
|
||||
{{- define "keycloak.initdbScriptsCM" -}}
|
||||
{{- if .Values.initdbScriptsConfigMap -}}
|
||||
{{- printf "%s" .Values.initdbScriptsConfigMap -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-init-scripts" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret containing the Keycloak admin password
|
||||
*/}}
|
||||
{{- define "keycloak.secretName" -}}
|
||||
{{- $secretName := .Values.auth.existingSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- if .Values.auth.existingSecret -}}
|
||||
{{- tpl .Values.auth.existingSecret . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- include "common.names.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -254,21 +85,134 @@ Return the secret containing the Keycloak admin password
|
||||
Return the secret key that contains the Keycloak admin password
|
||||
*/}}
|
||||
{{- define "keycloak.secretKey" -}}
|
||||
{{- $secretName := .Values.auth.existingSecret -}}
|
||||
{{- if and $secretName .Values.auth.passwordSecretKey -}}
|
||||
{{- printf "%s" .Values.auth.passwordSecretKey -}}
|
||||
{{- if and .Values.auth.existingSecret .Values.auth.passwordSecretKey -}}
|
||||
{{- tpl .Values.auth.passwordSecretKey . -}}
|
||||
{{- else -}}
|
||||
{{- print "admin-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the keycloak-config-cli configuration ConfigMap name.
|
||||
*/}}
|
||||
{{- define "keycloak.keycloakConfigCli.configmapName" -}}
|
||||
{{- if .Values.keycloakConfigCli.existingConfigmap -}}
|
||||
{{- tpl .Values.keycloakConfigCli.existingConfigmap . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-keycloak-config-cli-configmap" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database hostname
|
||||
*/}}
|
||||
{{- define "keycloak.database.host" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- include "keycloak.postgresql.fullname" . -}}{{- if eq .Values.postgresql.architecture "replication" }}-primary{{- end -}}
|
||||
{{- else -}}
|
||||
{{- tpl .Values.externalDatabase.host . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database port
|
||||
*/}}
|
||||
{{- define "keycloak.database.port" -}}
|
||||
{{- ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database database name
|
||||
*/}}
|
||||
{{- define "keycloak.database.name" -}}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
{{- coalesce (((.Values.global).postgresql).auth).database .Values.postgresql.auth.database "postgres" -}}
|
||||
{{- else -}}
|
||||
{{- tpl .Values.externalDatabase.database . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database user
|
||||
*/}}
|
||||
{{- define "keycloak.database.user" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- coalesce (((.Values.global).postgresql).auth).username .Values.postgresql.auth.username | default "" -}}
|
||||
{{- else -}}
|
||||
{{- tpl .Values.externalDatabase.user . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database schema
|
||||
*/}}
|
||||
{{- define "keycloak.database.schema" -}}
|
||||
{{- ternary "public" .Values.externalDatabase.schema .Values.postgresql.enabled -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return extra connection parameters for the Database DSN
|
||||
*/}}
|
||||
{{- define "keycloak.database.extraParams" -}}
|
||||
{{- if .Values.externalDatabase.extraParams -}}
|
||||
{{- printf "&%s" (tpl .Values.externalDatabase.extraParams .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database secret name
|
||||
*/}}
|
||||
{{- define "keycloak.database.secretName" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if not (empty (coalesce (((.Values.global).postgresql).auth).existingSecret .Values.postgresql.auth.existingSecret | default "")) -}}
|
||||
{{- tpl (coalesce (((.Values.global).postgresql).auth).existingSecret .Values.postgresql.auth.existingSecret) . -}}
|
||||
{{- else -}}
|
||||
{{- include "keycloak.postgresql.fullname" . -}}
|
||||
{{- end -}}
|
||||
{{- else if not (empty .Values.externalDatabase.existingSecret) -}}
|
||||
{{- tpl .Values.externalDatabase.existingSecret . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-externaldb" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database secret key that contains the database user
|
||||
*/}}
|
||||
{{- define "keycloak.database.secretUserKey" -}}
|
||||
{{- default "db-user" .Values.externalDatabase.existingSecretUserKey -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Database secret key that contains the database password
|
||||
*/}}
|
||||
{{- define "keycloak.database.secretPasswordKey" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- default "password" .Values.postgresql.auth.secretKeys.userPasswordKey -}}
|
||||
{{- else if .Values.externalDatabase.existingSecret -}}
|
||||
{{- default "db-password" .Values.externalDatabase.existingSecretPasswordKey -}}
|
||||
{{- else -}}
|
||||
{{- print "db-password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Keycloak initdb scripts ConfigMap name.
|
||||
*/}}
|
||||
{{- define "keycloak.initdbScripts.configmapName" -}}
|
||||
{{- if .Values.initdbScriptsConfigMap -}}
|
||||
{{- tpl .Values.initdbScriptsConfigMap . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-init-scripts" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret containing Keycloak HTTPS/TLS certificates
|
||||
*/}}
|
||||
{{- define "keycloak.tlsSecretName" -}}
|
||||
{{- $secretName := .Values.tls.existingSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- define "keycloak.tls.secretName" -}}
|
||||
{{- if .Values.tls.existingSecret -}}
|
||||
{{- tpl .Values.tls.existingSecret . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
@@ -277,36 +221,14 @@ Return the secret containing Keycloak HTTPS/TLS certificates
|
||||
{{/*
|
||||
Return the secret containing Keycloak HTTPS/TLS keystore and truststore passwords
|
||||
*/}}
|
||||
{{- define "keycloak.tlsPasswordsSecretName" -}}
|
||||
{{- $secretName := .Values.tls.passwordsSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- define "keycloak.tls.passwordsSecretName" -}}
|
||||
{{- if .Values.tls.passwordsSecret -}}
|
||||
{{- tpl .Values.tls.passwordsSecret . -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-tls-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret containing Keycloak SPI TLS certificates
|
||||
*/}}
|
||||
{{- define "keycloak.spiPasswordsSecretName" -}}
|
||||
{{- $secretName := .Values.spi.passwordsSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-spi-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS secret object should be created
|
||||
*/}}
|
||||
{{- define "keycloak.createTlsSecret" -}}
|
||||
{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message.
|
||||
*/}}
|
||||
@@ -325,7 +247,7 @@ Compile all warnings into a single message.
|
||||
|
||||
{{/* Validate values of Keycloak - database */}}
|
||||
{{- define "keycloak.validateValues.database" -}}
|
||||
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.host) (and (not .Values.externalDatabase.password) (not .Values.externalDatabase.existingSecret)) -}}
|
||||
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.host) -}}
|
||||
keycloak: database
|
||||
You disabled the PostgreSQL sub-chart but did not specify an external PostgreSQL host.
|
||||
Either deploy the PostgreSQL sub-chart (--set postgresql.enabled=true),
|
||||
@@ -337,19 +259,19 @@ keycloak: database
|
||||
|
||||
{{/* Validate values of Keycloak - TLS enabled */}}
|
||||
{{- define "keycloak.validateValues.tls" -}}
|
||||
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) }}
|
||||
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (not .Values.tls.existingSecret) }}
|
||||
keycloak: tls.enabled
|
||||
In order to enable TLS, you also need to provide
|
||||
an existing secret containing the Keystore and Truststore or
|
||||
enable auto-generated certificates.
|
||||
In order to enable TLS, you need to provide a secret with the TLS
|
||||
certificates (--set tls.existingSecret=FOO) or enable auto-generated
|
||||
TLS certificates (--set tls.autoGenerated.enabled=true).
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Keycloak - Production mode enabled */}}
|
||||
{{- define "keycloak.validateValues.production" -}}
|
||||
{{- if and .Values.production (not .Values.tls.enabled) (not (eq .Values.proxy "edge")) (empty .Values.proxyHeaders) -}}
|
||||
{{- if and .Values.production (not .Values.tls.enabled) (empty .Values.proxyHeaders) -}}
|
||||
keycloak: production
|
||||
In order to enable Production mode, you also need to enable HTTPS/TLS
|
||||
using the value 'tls.enabled' and providing an existing secret containing the Keystore and Trustore.
|
||||
In order to enable Production mode, you also need to enable
|
||||
HTTPS/TLS (--set tls.enabled=true) or use proxy headers (--set proxyHeaders=FOO).
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
39
charts/keycloak/templates/_init_containers.tpl
Normal file
39
charts/keycloak/templates/_init_containers.tpl
Normal file
@@ -0,0 +1,39 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that copies writable directories to an empty dir volume in order to not break the application functionality
|
||||
*/}}
|
||||
{{- define "keycloak.defaultInitContainers.prepareWriteDirs" -}}
|
||||
- name: prepare-write-dirs
|
||||
image: {{ template "keycloak.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.defaultInitContainers.prepareWriteDirs.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.defaultInitContainers.prepareWriteDirs.containerSecurityContext "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.defaultInitContainers.prepareWriteDirs.resources }}
|
||||
resources: {{- toYaml .Values.defaultInitContainers.prepareWriteDirs.resources | nindent 4 }}
|
||||
{{- else if ne .Values.defaultInitContainers.prepareWriteDirs.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.defaultInitContainers.prepareWriteDirs.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
. /opt/bitnami/scripts/liblog.sh
|
||||
|
||||
info "Copying writable dirs to empty dir"
|
||||
# In order to not break the application functionality we need to make some
|
||||
# directories writable, so we need to copy it to an empty dir volume
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/lib/quarkus /emptydir/app-quarkus-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/data /emptydir/app-data-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/providers /emptydir/app-providers-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/themes /emptydir/app-themes-dir
|
||||
info "Copy operation completed"
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /emptydir
|
||||
{{- end -}}
|
||||
53
charts/keycloak/templates/ca-cert.yaml
Normal file
53
charts/keycloak/templates/ca-cert.yaml
Normal file
@@ -0,0 +1,53 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }}
|
||||
{{- if empty .Values.tls.autoGenerated.certManager.existingIssuer }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-clusterissuer" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
{{- end }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
commonName: {{ printf "%s-ca" (include "common.names.fullname" .) }}
|
||||
isCA: true
|
||||
issuerRef:
|
||||
name: {{ default (printf "%s-clusterissuer" (include "common.names.fullname" .)) .Values.tls.autoGenerated.certManager.existingIssuer }}
|
||||
kind: {{ default "Issuer" .Values.tls.autoGenerated.certManager.existingIssuerKind }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ printf "%s-ca-crt" (include "common.names.fullname" .) }}
|
||||
{{- end }}
|
||||
44
charts/keycloak/templates/cert.yaml
Normal file
44
charts/keycloak/templates/cert.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "cert-manager") }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-crt" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
secretName: {{ template "keycloak.tls.secretName" . }}
|
||||
commonName: {{ printf "%s.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain }}
|
||||
issuerRef:
|
||||
name: {{ printf "%s-ca-issuer" (include "common.names.fullname" .) }}
|
||||
kind: Issuer
|
||||
subject:
|
||||
organizations:
|
||||
- "Keycloak"
|
||||
dnsNames:
|
||||
- '*.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
- '*.{{ include "common.names.fullname" . }}'
|
||||
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
- '*.{{ include "keycloak.headless.serviceName" . }}'
|
||||
- '*.{{ include "keycloak.headless.serviceName" . }}.{{ include "common.names.namespace" . }}'
|
||||
- '*.{{ include "keycloak.headless.serviceName" . }}.{{ include "common.names.namespace" . }}.svc'
|
||||
- '*.{{ include "keycloak.headless.serviceName" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }}'
|
||||
privateKey:
|
||||
algorithm: {{ .Values.tls.autoGenerated.certManager.keyAlgorithm }}
|
||||
size: {{ int .Values.tls.autoGenerated.certManager.keySize }}
|
||||
duration: {{ .Values.tls.autoGenerated.certManager.duration }}
|
||||
renewBefore: {{ .Values.tls.autoGenerated.certManager.renewBefore }}
|
||||
{{- end }}
|
||||
@@ -8,102 +8,78 @@ kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-env-vars" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
BITNAMI_DEBUG: {{ ternary "true" "false" .Values.image.debug | quote }}
|
||||
KEYCLOAK_PRODUCTION: {{ ternary "true" "false" .Values.production | quote }}
|
||||
KC_LOG_LEVEL: {{ .Values.logging.level | quote }}
|
||||
KC_LOG_CONSOLE_OUTPUT: {{ .Values.logging.output | quote }}
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME: {{ .Values.auth.adminUser | quote }}
|
||||
KEYCLOAK_HTTP_PORT: {{ .Values.containerPorts.http | quote }}
|
||||
{{- if and .Values.proxy (empty .Values.proxyHeaders) }}
|
||||
KEYCLOAK_PROXY_HEADERS: {{ ternary "" "xforwarded" (eq .Values.proxy "passthrough") | quote }}
|
||||
{{- else }}
|
||||
KEYCLOAK_PROXY_HEADERS: {{ .Values.proxyHeaders | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD_FILE: {{ printf "/opt/bitnami/keycloak/secrets/%s" (include "keycloak.secretKey" .) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.adminIngress.enabled .Values.adminIngress.hostname }}
|
||||
KEYCLOAK_HOSTNAME_ADMIN: |-
|
||||
{{ ternary "https://" "http://" ( or .Values.adminIngress.tls (eq .Values.proxy "edge") (not (empty .Values.proxyHeaders)) ) -}} {{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.hostname "context" $) -}}
|
||||
{{- if eq .Values.adminIngress.controller "default" }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.adminIngress.path "context" $) }}
|
||||
{{- else if eq .Values.adminIngress.controller "gce" }}
|
||||
{{- $path := .Values.adminIngress.path -}}
|
||||
{{- if hasSuffix "*" $path -}}
|
||||
{{- $path = trimSuffix "*" $path -}}
|
||||
{{- end -}}
|
||||
{{- include "common.tplvalues.render" (dict "value" $path "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.enabled .Values.ingress.hostname }}
|
||||
KEYCLOAK_HOSTNAME: |-
|
||||
{{ ternary "https://" "http://" ( or .Values.ingress.tls (eq .Values.proxy "edge") (not (empty .Values.proxyHeaders)) ) -}} {{- include "common.tplvalues.render" (dict "value" .Values.ingress.hostname "context" $) -}}
|
||||
{{- if eq .Values.ingress.controller "default" }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.path "context" $) }}
|
||||
{{- else if eq .Values.ingress.controller "gce" }}
|
||||
{{- $path := .Values.ingress.path -}}
|
||||
{{- if hasSuffix "*" $path -}}
|
||||
{{- $path = trimSuffix "*" $path -}}
|
||||
{{- end -}}
|
||||
{{- include "common.tplvalues.render" (dict "value" $path "context" $) }}
|
||||
{{- end }}
|
||||
KC_HTTP_PORT: {{ .Values.containerPorts.http | quote }}
|
||||
KC_HTTP_MANAGEMENT_PORT: {{ .Values.containerPorts.management | quote }}
|
||||
KC_HTTP_ENABLED: {{ ternary "true" "false" (or .Values.httpEnabled (not .Values.tls.enabled)) | quote }}
|
||||
{{- if .Values.proxyHeaders }}
|
||||
KC_PROXY_HEADERS: {{ .Values.proxyHeaders | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
KEYCLOAK_HOSTNAME_STRICT: {{ ternary "true" "false" .Values.ingress.hostnameStrict | quote }}
|
||||
KC_HOSTNAME_STRICT: {{ ternary "true" "false" .Values.hostnameStrict | quote }}
|
||||
{{- if .Values.ingress.hostname }}
|
||||
{{- $path := tpl .Values.ingress.path . }}
|
||||
{{- if and (eq .Values.ingress.controller "gce") (hasSuffix "*" $path) }}
|
||||
{{- $path = trimSuffix "*" $path }}
|
||||
{{- end }}
|
||||
KEYCLOAK_ENABLE_STATISTICS: {{ ternary "true" "false" .Values.metrics.enabled | quote }}
|
||||
{{- if not .Values.externalDatabase.existingSecretHostKey }}
|
||||
KEYCLOAK_DATABASE_HOST: {{ include "keycloak.databaseHost" . | quote }}
|
||||
KC_HOSTNAME: {{ printf "%s://%s%s" (ternary "https" "http" (or .Values.ingress.tls (not (empty .Values.proxyHeaders)))) (tpl .Values.ingress.hostname .) $path | quote }}
|
||||
{{- end }}
|
||||
{{- if not .Values.externalDatabase.existingSecretPortKey }}
|
||||
KEYCLOAK_DATABASE_PORT: {{ include "keycloak.databasePort" . }}
|
||||
{{- end }}
|
||||
KC_METRICS_ENABLED: {{ ternary "true" "false" .Values.metrics.enabled | quote }}
|
||||
KC_DB_URL: {{ printf "jdbc:postgresql://%s:%d/%s?currentSchema=%s%s" (include "keycloak.database.host" .) (include "keycloak.database.port" . | int) (include "keycloak.database.name" .) (include "keycloak.database.schema" .) (include "keycloak.database.extraParams" .) | quote }}
|
||||
KC_DB_SCHEMA: {{ include "keycloak.database.schema" . | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
KC_DB_PASSWORD_FILE: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.database.secretPasswordKey" .) }}
|
||||
{{- if .Values.externalDatabase.existingSecretUserKey }}
|
||||
KC_DB_USERNAME_FILE: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.database.secretUserKey" .) }}
|
||||
{{- end }}
|
||||
{{- if not .Values.externalDatabase.existingSecretDatabaseKey }}
|
||||
KEYCLOAK_DATABASE_NAME: {{ include "keycloak.databaseName" . | quote }}
|
||||
{{- end }}
|
||||
{{- if not (and .Values.externalDatabase.existingSecret .Values.externalDatabase.existingSecretUserKey) }}
|
||||
KC_DB_USERNAME: {{ include "keycloak.database.user" . | quote }}
|
||||
{{- end }}
|
||||
KEYCLOAK_DATABASE_SCHEMA: {{ include "keycloak.databaseSchema" . }}
|
||||
{{- if not .Values.externalDatabase.existingSecretUserKey }}
|
||||
KEYCLOAK_DATABASE_USER: {{ include "keycloak.databaseUser" . | quote }}
|
||||
{{- end }}
|
||||
KEYCLOAK_PRODUCTION: {{ ternary "true" "false" .Values.production | quote }}
|
||||
KEYCLOAK_ENABLE_HTTPS: {{ ternary "true" "false" .Values.tls.enabled | quote }}
|
||||
{{- if .Values.customCaExistingSecret }}
|
||||
KC_TRUSTSTORE_PATHS: "/opt/bitnami/keycloak/custom-ca"
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
KEYCLOAK_HTTPS_PORT: {{ .Values.containerPorts.https | quote }}
|
||||
KEYCLOAK_HTTPS_USE_PEM: {{ ternary "true" "false" (or .Values.tls.usePem .Values.tls.autoGenerated) | quote }}
|
||||
{{- if or .Values.tls.usePem .Values.tls.autoGenerated }}
|
||||
KEYCLOAK_HTTPS_CERTIFICATE_FILE: "/opt/bitnami/keycloak/certs/tls.crt"
|
||||
KEYCLOAK_HTTPS_CERTIFICATE_KEY_FILE: "/opt/bitnami/keycloak/certs/tls.key"
|
||||
{{- if .Values.tls.enabled }}
|
||||
KEYCLOAK_ENABLE_HTTPS: "true"
|
||||
KC_HTTPS_PORT: {{ .Values.containerPorts.https | quote }}
|
||||
{{- if or .Values.tls.usePemCerts .Values.tls.autoGenerated.enabled }}
|
||||
KEYCLOAK_HTTPS_USE_PEM: "true"
|
||||
KC_HTTPS_CERTIFICATE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" (ternary "tls.crt" .Values.tls.certFilename .Values.tls.autoGenerated.enabled) | quote }}
|
||||
KC_HTTPS_CERTIFICATE_KEY_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" (ternary "tls.key" .Values.tls.certKeyFilename .Values.tls.autoGenerated.enabled) | quote }}
|
||||
{{- else }}
|
||||
KEYCLOAK_HTTPS_KEY_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.keystoreFilename | quote }}
|
||||
KEYCLOAK_HTTPS_TRUST_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.truststoreFilename | quote }}
|
||||
KC_HTTPS_KEY_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.keystoreFilename | quote }}
|
||||
KC_HTTPS_TRUST_STORE_FILE: {{ printf "/opt/bitnami/keycloak/certs/%s" .Values.tls.truststoreFilename | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.trustedCertsExistingSecret }}
|
||||
KC_TRUSTSTORE_PATHS: "/opt/bitnami/keycloak/truststore"
|
||||
{{- end }}
|
||||
{{- if .Values.spi.existingSecret }}
|
||||
{{- if .Values.spi.hostnameVerificationPolicy }}
|
||||
KEYCLOAK_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY: {{ .Values.spi.hostnameVerificationPolicy | quote }}
|
||||
{{- end }}
|
||||
KEYCLOAK_SPI_TRUSTSTORE_FILE: {{ printf "/opt/bitnami/keycloak/spi-certs/%s" .Values.spi.truststoreFilename }}
|
||||
{{- end }}
|
||||
{{- if .Values.cache.enabled }}
|
||||
KC_CACHE_TYPE: "ispn"
|
||||
KC_CACHE: {{ ternary "ispn" "local" .Values.cache.enabled | quote }}
|
||||
{{- if .Values.cache.enabled }}
|
||||
{{- if .Values.cache.stack }}
|
||||
KC_CACHE_STACK: {{ .Values.cache.stack | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.cache.configFile }}
|
||||
KC_CACHE_CONFIG_FILE: {{ .Values.cache.configFile | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.cache.useHeadlessServiceWithAppVersion }}
|
||||
JAVA_OPTS_APPEND: {{ printf "-Djgroups.dns.query=%s-headless-ispn-%s.%s.svc.%s" (include "common.names.fullname" .) (replace "." "-" .Chart.AppVersion) (include "common.names.namespace" .) .Values.clusterDomain | quote }}
|
||||
{{- else }}
|
||||
JAVA_OPTS_APPEND: {{ printf "-Djgroups.dns.query=%s-headless.%s.svc.%s" (include "common.names.fullname" .) (include "common.names.namespace" .) .Values.clusterDomain | quote }}
|
||||
JAVA_OPTS_APPEND: {{ printf "-Djgroups.dns.query=%s.%s.svc.%s" (ternary (include "keycloak.headless.ispn.serviceName" .) (include "keycloak.headless.serviceName" .) .Values.cache.useHeadlessServiceWithAppVersion) (include "common.names.namespace" .) .Values.clusterDomain | quote }}
|
||||
{{- end }}
|
||||
KC_HTTP_RELATIVE_PATH: {{ .Values.httpRelativePath | quote }}
|
||||
{{- if .Values.adminRealm }}
|
||||
KC_SPI_ADMIN_REALM: {{ .Values.adminRealm | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
KC_CACHE_TYPE: "local"
|
||||
{{- if .Values.extraStartupArgs }}
|
||||
KEYCLOAK_EXTRA_ARGS: {{ .Values.extraStartupArgs | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.logging }}
|
||||
KEYCLOAK_LOG_OUTPUT: {{ .Values.logging.output | quote }}
|
||||
KEYCLOAK_LOG_LEVEL: {{ .Values.logging.level | quote }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -3,16 +3,17 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "keycloak.createConfigmap" .) }}
|
||||
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configuration" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
keycloak.conf: |-
|
||||
|
||||
@@ -7,37 +7,38 @@ SPDX-License-Identifier: APACHE-2.0
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless-ispn-%s" (include "common.names.fullname" .) (replace "." "-" .Chart.AppVersion) | trunc 63 | trimSuffix "-" }}
|
||||
name: {{ template "keycloak.headless.ispn.serviceName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.service.headless.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
{{- if .Values.service.http.enabled }}
|
||||
- name: http
|
||||
port: {{ .Values.containerPorts.http }}
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ .Values.containerPorts.https }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraHeadlessPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraHeadlessPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.headless.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.headless.extraPorts "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.headless.extraPorts "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
publishNotReadyAddresses: true
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/app-version: {{ .Chart.AppVersion }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
app.kubernetes.io/app-version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
|
||||
@@ -6,35 +6,36 @@ SPDX-License-Identifier: APACHE-2.0
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
name: {{ template "keycloak.headless.serviceName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.service.headless.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
{{- if .Values.service.http.enabled }}
|
||||
- name: http
|
||||
port: {{ .Values.containerPorts.http }}
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ .Values.containerPorts.https }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraHeadlessPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraHeadlessPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.headless.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.headless.extraPorts "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.headless.extraPorts "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
publishNotReadyAddresses: true
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
|
||||
@@ -3,56 +3,57 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
|
||||
{{- if .Values.autoscaling.hpa.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" (dict "context" .) }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
minReplicas: {{ .Values.autoscaling.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPU }}
|
||||
{{- if .Values.autoscaling.hpa.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPU }}
|
||||
averageUtilization: {{ .Values.autoscaling.hpa.targetCPU }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemory }}
|
||||
{{- if .Values.autoscaling.hpa.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemory }}
|
||||
averageUtilization: {{ .Values.autoscaling.hpa.targetMemory }}
|
||||
{{- end }}
|
||||
{{- if or .Values.autoscaling.behavior.scaleDown.policies .Values.autoscaling.behavior.scaleUp.policies }}
|
||||
{{- if or .Values.autoscaling.hpa.behavior.scaleDown.policies .Values.autoscaling.hpa.behavior.scaleUp.policies }}
|
||||
behavior:
|
||||
{{- if .Values.autoscaling.behavior.scaleDown.policies }}
|
||||
{{- if .Values.autoscaling.hpa.behavior.scaleDown.policies }}
|
||||
scaleDown:
|
||||
stabilizationWindowSeconds: {{ .Values.autoscaling.behavior.scaleDown.stabilizationWindowSeconds }}
|
||||
selectPolicy: {{ .Values.autoscaling.behavior.scaleDown.selectPolicy }}
|
||||
stabilizationWindowSeconds: {{ .Values.autoscaling.hpa.behavior.scaleDown.stabilizationWindowSeconds }}
|
||||
selectPolicy: {{ .Values.autoscaling.hpa.behavior.scaleDown.selectPolicy }}
|
||||
policies:
|
||||
{{- toYaml .Values.autoscaling.behavior.scaleDown.policies | nindent 8 }}
|
||||
{{- toYaml .Values.autoscaling.hpa.behavior.scaleDown.policies | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.behavior.scaleUp.policies }}
|
||||
{{- if .Values.autoscaling.hpa.behavior.scaleUp.policies }}
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: {{ .Values.autoscaling.behavior.scaleUp.stabilizationWindowSeconds }}
|
||||
selectPolicy: {{ .Values.autoscaling.behavior.scaleUp.selectPolicy }}
|
||||
stabilizationWindowSeconds: {{ .Values.autoscaling.hpa.behavior.scaleUp.stabilizationWindowSeconds }}
|
||||
selectPolicy: {{ .Values.autoscaling.hpa.behavior.scaleUp.selectPolicy }}
|
||||
policies:
|
||||
{{- toYaml .Values.autoscaling.behavior.scaleUp.policies | nindent 8 }}
|
||||
{{- toYaml .Values.autoscaling.hpa.behavior.scaleUp.policies | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
48
charts/keycloak/templates/ingress-tls-secret.yaml
Normal file
48
charts/keycloak/templates/ingress-tls-secret.yaml
Normal file
@@ -0,0 +1,48 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- if .Values.ingress.secrets }}
|
||||
{{- range .Values.ingress.secrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $.Values.commonLabels "context" $) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $.Values.commonAnnotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ .certificate | b64enc }}
|
||||
tls.key: {{ .key | b64enc }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
|
||||
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- $ca := genCA "keycloak-ca" 365 }}
|
||||
{{- $cert := genSignedCert (tpl .Values.ingress.hostname .) nil (list (tpl .Values.ingress.hostname .)) 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -9,16 +9,17 @@ kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- $labels := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.labels .Values.commonLabels) "context" .) }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $labels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.ingress.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.ingressClassName }}
|
||||
ingressClassName: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.ingressClassName "context" $ ) | quote }}
|
||||
ingressClassName: {{ tpl .Values.ingress.ingressClassName . | quote }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.ingress.hostname }}
|
||||
@@ -28,9 +29,9 @@ spec:
|
||||
{{- if .Values.ingress.extraPaths }}
|
||||
{{- toYaml .Values.ingress.extraPaths | nindent 10 }}
|
||||
{{- end }}
|
||||
- path: {{ include "common.tplvalues.render" ( dict "value" .Values.ingress.path "context" $) }}
|
||||
- path: {{ tpl .Values.ingress.path . | quote }}
|
||||
pathType: {{ .Values.ingress.pathType }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" .Values.ingress.servicePort "context" $) | nindent 14 }}
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" .Values.ingress.servicePort "context" .) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- range .Values.ingress.extraHosts }}
|
||||
- host: {{ (tpl .name $) }}
|
||||
@@ -41,17 +42,17 @@ spec:
|
||||
backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" $.Values.ingress.servicePort "context" $) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraRules }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.selfSigned .Values.ingress.secrets )) .Values.ingress.extraTls }}
|
||||
{{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" (dict "annotations" .Values.ingress.annotations)) .Values.ingress.selfSigned .Values.ingress.secrets)) .Values.ingress.extraTls }}
|
||||
tls:
|
||||
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" .Values.ingress.annotations )) .Values.ingress.secrets .Values.ingress.selfSigned) }}
|
||||
{{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" (dict "annotations" .Values.ingress.annotations)) .Values.ingress.secrets .Values.ingress.selfSigned) }}
|
||||
- hosts:
|
||||
- {{ (tpl .Values.ingress.hostname .) | quote }}
|
||||
secretName: {{ printf "%s-tls" (tpl .Values.ingress.hostname .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingress.extraTls }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraTls "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -9,10 +9,11 @@ kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-init-scripts" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initdbScripts "context" .) | nindent 2 }}
|
||||
|
||||
@@ -3,14 +3,18 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if (include "keycloak.keycloakConfigCli.createConfigmap" .) }}
|
||||
{{- if and .Values.keycloakConfigCli.enabled .Values.keycloakConfigCli.configuration (not .Values.keycloakConfigCli.existingConfigmap) -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "keycloak.keycloakConfigCli.configmapName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak-config-cli
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- range $fileName, $fileContent := .Values.keycloakConfigCli.configuration }}
|
||||
{{- if $fileContent }}
|
||||
|
||||
@@ -9,12 +9,12 @@ kind: Job
|
||||
metadata:
|
||||
name: {{ printf "%s-keycloak-config-cli" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak-config-cli
|
||||
{{- if or .Values.keycloakConfigCli.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.keycloakConfigCli.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- $defaultAnnotations := ternary (dict "helm.sh/hook" "post-install,post-upgrade,post-rollback" "helm.sh/hook-delete-policy" "before-hook-creation,hook-succeeded" "helm.sh/hook-weight" "5") (dict) .Values.useHelmHooks }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.keycloakConfigCli.annotations .Values.commonAnnotations $defaultAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
spec:
|
||||
backoffLimit: {{ .Values.keycloakConfigCli.backoffLimit }}
|
||||
{{- if .Values.keycloakConfigCli.cleanupAfterFinished.enabled }}
|
||||
@@ -22,58 +22,61 @@ spec:
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.keycloakConfigCli.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.keycloakConfigCli.podLabels .Values.commonLabels) "context" .) }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $podLabels "context" .) | nindent 8 }}
|
||||
app.kubernetes.io/component: keycloak-config-cli
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
annotations:
|
||||
{{- if (include "keycloak.keycloakConfigCli.createConfigmap" .) }}
|
||||
{{- if and .Values.keycloakConfigCli.configuration (not .Values.keycloakConfigCli.existingConfigmap) }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/keycloak-config-cli-configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.podAnnotations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
|
||||
{{- include "keycloak.imagePullSecrets" . | nindent 6 }}
|
||||
restartPolicy: Never
|
||||
{{- if .Values.keycloakConfigCli.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.podSecurityContext "context" $) | nindent 8 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.podSecurityContext "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.keycloakConfigCli.automountServiceAccountToken }}
|
||||
{{- if .Values.keycloakConfigCli.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.hostAliases "context" $) | nindent 8 }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.hostAliases "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.nodeSelector "context" $) | nindent 8 }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.nodeSelector "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.podTolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.podTolerations "context" .) | nindent 8 }}
|
||||
{{- if .Values.keycloakConfigCli.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.initContainers }}
|
||||
initContainers:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.initContainers "context" $) | nindent 8 }}
|
||||
initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.initContainers "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: keycloak-config-cli
|
||||
image: {{ template "keycloak.keycloakConfigCli.image" . }}
|
||||
imagePullPolicy: {{ .Values.keycloakConfigCli.image.pullPolicy }}
|
||||
{{- if .Values.keycloakConfigCli.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
{{- if .Values.keycloakConfigCli.command }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.command "context" .) | nindent 12 }}
|
||||
{{- else }}
|
||||
- java
|
||||
{{- end }}
|
||||
args:
|
||||
{{- if .Values.keycloakConfigCli.args }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.args "context" .) | nindent 12 }}
|
||||
{{- else }}
|
||||
- -jar
|
||||
- /opt/bitnami/keycloak-config-cli/keycloak-config-cli.jar
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.containerSecurityContext "context" $) | nindent 12 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.keycloakConfigCli.containerSecurityContext "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
# ref: https://github.com/adorsys/keycloak-config-cli?tab=readme-ov-file#configuration
|
||||
- name: KEYCLOAK_URL
|
||||
value: {{ printf "http://%s-headless:%d%s" (include "common.names.fullname" .) (.Values.containerPorts.http | int) (.Values.httpRelativePath) }}
|
||||
value: {{ printf "http://%s:%d%s" (include "keycloak.headless.serviceName" .) (.Values.containerPorts.http | int) (.Values.httpRelativePath) }}
|
||||
- name: KEYCLOAK_USER
|
||||
value: {{ .Values.auth.adminUser | quote }}
|
||||
- name: KEYCLOAK_PASSWORD
|
||||
@@ -92,17 +95,17 @@ spec:
|
||||
value: {{ .Values.keycloakConfigCli.availabilityCheck.timeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVars "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.keycloakConfigCli.extraEnvVarsCM .Values.keycloakConfigCli.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.keycloakConfigCli.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVarsCM "context" $) }}
|
||||
name: {{ tpl .Values.keycloakConfigCli.extraEnvVarsCM . }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraEnvVarsSecret "context" $) }}
|
||||
name: {{ tpl .Values.keycloakConfigCli.extraEnvVarsSecret . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap .Values.keycloakConfigCli.extraVolumeMounts }}
|
||||
@@ -115,7 +118,7 @@ spec:
|
||||
mountPath: /config
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumeMounts "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.resources }}
|
||||
@@ -124,9 +127,8 @@ spec:
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.keycloakConfigCli.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.keycloakConfigCli.sidecars "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" ("value" .Values.keycloakConfigCli.sidecars "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.keycloakConfigCli.configuration .Values.keycloakConfigCli.existingConfigmap .Values.keycloakConfigCli.extraVolumes }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
@@ -136,7 +138,6 @@ spec:
|
||||
name: {{ include "keycloak.keycloakConfigCli.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.keycloakConfigCli.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.keycloakConfigCli.extraVolumes "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -9,33 +9,25 @@ kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-metrics" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.metrics.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.service.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: metrics
|
||||
- name: tcp-metrics
|
||||
port: {{ .Values.metrics.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.containerPorts.metrics }}
|
||||
- name: http
|
||||
port: {{ .Values.metrics.service.ports.http }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.containerPorts.http }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ .Values.metrics.service.ports.https }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.containerPorts.https }}
|
||||
{{- end }}
|
||||
targetPort: management
|
||||
{{- if .Values.metrics.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.service.extraPorts "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- end }}
|
||||
|
||||
@@ -9,16 +9,18 @@ apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 6 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
@@ -38,7 +40,7 @@ spec:
|
||||
{{- end }}
|
||||
# Allow connection to PostgreSQL
|
||||
- ports:
|
||||
- port: {{ include "keycloak.databasePort" . | trimAll "\"" | int }}
|
||||
- port: {{ include "keycloak.database.port" . | int }}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
to:
|
||||
- podSelector:
|
||||
@@ -46,7 +48,7 @@ spec:
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
# Allow connection to other keycloak nodes
|
||||
# Allow connection to other Keycloak nodes
|
||||
- ports:
|
||||
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
|
||||
- port: 7800
|
||||
@@ -56,30 +58,37 @@ spec:
|
||||
{{- end }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" .Values.commonLabels "context" .) | nindent 14 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.extraEgress "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
|
||||
- port: 7800
|
||||
{{- if and (.Values.metrics.enabled) (not (eq (.Values.containerPorts.http | int) (.Values.containerPorts.metrics | int) )) }}
|
||||
- port: {{ .Values.containerPorts.metrics }} # metrics and health
|
||||
{{- end }}
|
||||
- port: {{ .Values.containerPorts.http }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- port: {{ .Values.containerPorts.https }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: {{ .Values.containerPorts.management }}
|
||||
{{- end }}
|
||||
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
|
||||
- port: 7800
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" .Values.commonLabels "context" .) | nindent 14 }}
|
||||
{{- if .Values.networkPolicy.addExternalClientAccess }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressPodMatchLabels }}
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressPodMatchLabels "context" .) | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
@@ -95,8 +104,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $extraIngress := coalesce .Values.networkPolicy.additionalRules .Values.networkPolicy.extraIngress }}
|
||||
{{- if $extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.extraIngress "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -9,20 +9,22 @@ kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.pdb.maxUnavailable ( not .Values.pdb.minAvailable ) }}
|
||||
{{- if or .Values.pdb.maxUnavailable (not .Values.pdb.minAvailable) }}
|
||||
maxUnavailable: {{ .Values.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 6 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- end }}
|
||||
|
||||
@@ -3,17 +3,18 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.groups}}
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled .Values.metrics.prometheusRule.groups }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- $labels := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.prometheusRule.labels .Values.commonLabels) "context" .) }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $labels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.groups "context" .) | nindent 4 }}
|
||||
|
||||
@@ -3,17 +3,19 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) (not .Values.postgresql.existingSecret) }}
|
||||
{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-externaldb" (include "common.names.fullname" .) }}
|
||||
{{- $secretName := printf "%s-externaldb" (include "common.names.fullname" .) }}
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.externalDatabase.annotations .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.externalDatabase.annotations .Values.commonAnnotations) "context" $) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.externalDatabase.annotations .Values.commonAnnotations) "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
db-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s-externaldb" (include "common.names.fullname" .)) "key" "db-password" "length" 10 "providedValues" (list "externalDatabase.password") "context" $) }}
|
||||
db-password: {{ include "common.secrets.passwords.manage" (dict "secret" $secretName "key" "db-password" "length" 10 "providedValues" (list "externalDatabase.password") "context" .) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -7,14 +7,15 @@ SPDX-License-Identifier: APACHE-2.0
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.auth.annotations .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.auth.annotations .Values.commonAnnotations) "context" $) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.auth.annotations .Values.commonAnnotations) "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
admin-password: {{ include "common.secrets.passwords.manage" (dict "secret" (printf "%s" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") "key" "admin-password" "length" 10 "providedValues" (list "auth.adminPassword") "context" $) }}
|
||||
admin-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "common.names.fullname" .) "key" "admin-password" "length" 10 "providedValues" (list "auth.adminPassword") "context" .) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -8,11 +8,12 @@ kind: Service
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.service.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
@@ -32,15 +33,15 @@ spec:
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- if .Values.service.http.enabled }}
|
||||
- name: http
|
||||
port: {{ coalesce .Values.service.ports.http .Values.service.port }}
|
||||
port: {{ .Values.service.ports.http }}
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http))) }}
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.http }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
@@ -48,18 +49,19 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: https
|
||||
port: {{ coalesce .Values.service.ports.https .Values.service.httpsPort }}
|
||||
port: {{ .Values.service.ports.https}}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https))) }}
|
||||
{{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https)) }}
|
||||
nodePort: {{ .Values.service.nodePorts.https }}
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
|
||||
@@ -9,14 +9,15 @@ kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "keycloak.serviceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.serviceAccount.extraLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.extraLabels "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.extraLabels "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.serviceAccount.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
|
||||
@@ -9,50 +9,50 @@ kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- $labels := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.serviceMonitor.labels .Values.commonLabels) "context" .) }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $labels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }}
|
||||
endpoints:
|
||||
{{- $defaultEndpoint := pick .Values.metrics.serviceMonitor "port" "scheme" "tlsConfig" "interval" "scrapeTimeout" "relabelings" "metricRelabelings" "honorLabels" }}
|
||||
{{- $endpoints := ternary (.Values.metrics.serviceMonitor.endpoints) (list (dict "path" .Values.metrics.serviceMonitor.path)) (empty .Values.metrics.serviceMonitor.path) }}
|
||||
{{- range $endpoints }}
|
||||
{{- $endpoint := merge . $defaultEndpoint }}
|
||||
- port: {{ $endpoint.port | quote }}
|
||||
scheme: {{ $endpoint.scheme | quote }}
|
||||
{{- if $endpoint.tlsConfig }}
|
||||
tlsConfig: {{- include "common.tplvalues.render" ( dict "value" $endpoint.tlsConfig "context" $) | nindent 8 }}
|
||||
- port: tcp-metrics
|
||||
path: "/metrics"
|
||||
{{- if .Values.tls.enabled }}
|
||||
scheme: https
|
||||
{{- if .Values.metrics.serviceMonitor.tlsConfig }}
|
||||
tlsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.tlsConfig "context" .) | nindent 8 }}
|
||||
{{- else if .Values.tls.autoGenerated.enabled }}
|
||||
tlsConfig:
|
||||
insecureSkipVerify: true
|
||||
{{- end }}
|
||||
path: {{ include "common.tplvalues.render" ( dict "value" $endpoint.path "context" $) }}
|
||||
{{- if $endpoint.interval }}
|
||||
interval: {{ $endpoint.interval }}
|
||||
{{- end }}
|
||||
{{- if $endpoint.scrapeTimeout }}
|
||||
scrapeTimeout: {{ $endpoint.scrapeTimeout }}
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if $endpoint.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" $endpoint.relabelings "context" $) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if $endpoint.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" $endpoint.metricRelabelings "context" $) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if $endpoint.honorLabels }}
|
||||
honorLabels: {{ $endpoint.honorLabels }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.relabelings "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" .Values.commonLabels "context" .) | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" .) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- end }}
|
||||
|
||||
@@ -8,27 +8,28 @@ kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.statefulsetAnnotations .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.merge" ( dict "values" ( list .Values.statefulsetAnnotations .Values.commonAnnotations ) "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.merge" (dict "values" (list .Values.statefulsetAnnotations .Values.commonAnnotations) "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
{{- if not .Values.autoscaling.hpa.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimitCount }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
updateStrategy:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
|
||||
updateStrategy: {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" .) | nindent 4 }}
|
||||
{{- if .Values.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.minReadySeconds }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.podLabels .Values.commonLabels) "context" .) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
matchLabels: {{- include "common.labels.matchLabels" (dict "customLabels" $podLabels "context" .) | nindent 6 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
@@ -36,32 +37,32 @@ spec:
|
||||
{{- if not .Values.auth.existingSecret }}
|
||||
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if (include "keycloak.createConfigmap" .) }}
|
||||
{{- if and .Values.configuration (not .Values.existingConfigmap) }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" $podLabels "context" .) | nindent 8 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/app-version: {{ .Chart.AppVersion }}
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
spec:
|
||||
serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
|
||||
{{- include "keycloak.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||
affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" .) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "component" "keycloak" "customLabels" $podLabels "context" .) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "component" "keycloak" "customLabels" $podLabels "context" .) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
|
||||
@@ -76,7 +77,7 @@ spec:
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ .Values.dnsPolicy }}
|
||||
@@ -88,41 +89,13 @@ spec:
|
||||
{{- if .Values.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if or .Values.enableDefaultInitContainers .Values.initContainers }}
|
||||
{{- if or .Values.defaultInitContainers.prepareWriteDirs.enabled .Values.initContainers }}
|
||||
initContainers:
|
||||
{{- if .Values.enableDefaultInitContainers }}
|
||||
- name: prepare-write-dirs
|
||||
image: {{ template "keycloak.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- /bin/bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
. /opt/bitnami/scripts/liblog.sh
|
||||
|
||||
info "Copying writable dirs to empty dir"
|
||||
# In order to not break the application functionality we need to make some
|
||||
# directories writable, so we need to copy it to an empty dir volume
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/lib/quarkus /emptydir/app-quarkus-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/data /emptydir/app-data-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/providers /emptydir/app-providers-dir
|
||||
cp -r --preserve=mode,timestamps /opt/bitnami/keycloak/themes /emptydir/app-themes-dir
|
||||
info "Copy operation completed"
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.resources }}
|
||||
resources: {{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- else if ne .Values.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /emptydir
|
||||
{{- if .Values.defaultInitContainers.prepareWriteDirs.enabled }}
|
||||
{{- include "keycloak.defaultInitContainers.prepareWriteDirs" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.initContainers }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
@@ -130,20 +103,20 @@ spec:
|
||||
image: {{ template "keycloak.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" .) | nindent 12 }}
|
||||
{{- else if .Values.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" .) | nindent 12 }}
|
||||
{{- else if .Values.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KUBERNETES_NAMESPACE
|
||||
@@ -151,125 +124,52 @@ spec:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" .Values.image.debug | quote }}
|
||||
{{- if .Values.usePasswordFiles }}
|
||||
- name: KC_BOOTSTRAP_ADMIN_PASSWORD_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/%s" (include "keycloak.secretKey" .) }}
|
||||
- name: KEYCLOAK_DATABASE_PASSWORD_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.databaseSecretPasswordKey" .) }}
|
||||
{{- if .Values.externalDatabase.existingSecretHostKey }}
|
||||
- name: KEYCLOAK_DATABASE_HOST_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.databaseSecretHostKey" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretPortKey }}
|
||||
- name: KEYCLOAK_DATABASE_PORT_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.databaseSecretPortKey" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretUserKey }}
|
||||
- name: KEYCLOAK_DATABASE_USER_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.databaseSecretUserKey" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretDatabaseKey }}
|
||||
- name: KEYCLOAK_DATABASE_NAME_FILE
|
||||
value: {{ printf "/opt/bitnami/keycloak/secrets/db-%s" (include "keycloak.databaseSecretDatabaseKey" .) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled (or .Values.tls.keystorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KEYCLOAK_HTTPS_KEY_STORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/keycloak/secrets/tls-keystore-password"
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled (or .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/keycloak/secrets/tls-truststore-password"
|
||||
{{- end }}
|
||||
{{- if and .Values.spi.existingSecret (or .Values.spi.truststorePassword .Values.spi.passwordsSecret) }}
|
||||
- name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD_FILE
|
||||
value: "/opt/bitnami/keycloak/secrets/spi-truststore-password"
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if not .Values.usePasswordFiles }}
|
||||
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.secretName" . }}
|
||||
key: {{ include "keycloak.secretKey" . }}
|
||||
- name: KEYCLOAK_DATABASE_PASSWORD
|
||||
- name: KC_DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: {{ include "keycloak.databaseSecretPasswordKey" . }}
|
||||
{{- if .Values.externalDatabase.existingSecretHostKey }}
|
||||
- name: KEYCLOAK_DATABASE_HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: {{ include "keycloak.databaseSecretHostKey" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretPortKey }}
|
||||
- name: KEYCLOAK_DATABASE_PORT
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: {{ include "keycloak.databaseSecretPortKey" . }}
|
||||
{{- end }}
|
||||
name: {{ include "keycloak.database.secretName" . }}
|
||||
key: {{ include "keycloak.database.secretPasswordKey" . }}
|
||||
{{- if .Values.externalDatabase.existingSecretUserKey }}
|
||||
- name: KEYCLOAK_DATABASE_USER
|
||||
- name: KC_DB_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: {{ include "keycloak.databaseSecretUserKey" . }}
|
||||
name: {{ include "keycloak.database.secretName" . }}
|
||||
key: {{ include "keycloak.database.secretUserKey" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretDatabaseKey }}
|
||||
- name: KEYCLOAK_DATABASE_NAME
|
||||
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (or .Values.tls.keystorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KC_HTTPS_KEY_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: {{ include "keycloak.databaseSecretDatabaseKey" . }}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled (or .Values.tls.keystorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KEYCLOAK_HTTPS_KEY_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.tlsPasswordsSecretName" . }}
|
||||
name: {{ include "keycloak.tls.passwordsSecretName" . }}
|
||||
key: "tls-keystore-password"
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled (or .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD
|
||||
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (or .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
|
||||
- name: KC_HTTPS_TRUST_STORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.tlsPasswordsSecretName" . }}
|
||||
name: {{ include "keycloak.tls.passwordsSecretName" . }}
|
||||
key: "tls-truststore-password"
|
||||
{{- end }}
|
||||
{{- if and .Values.spi.existingSecret (or .Values.spi.truststorePassword .Values.spi.passwordsSecret) }}
|
||||
- name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "keycloak.spiPasswordsSecretName" . }}
|
||||
key: "spi-truststore-password"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: KEYCLOAK_HTTP_RELATIVE_PATH
|
||||
value: {{ .Values.httpRelativePath | quote }}
|
||||
{{- if .Values.extraStartupArgs }}
|
||||
- name: KEYCLOAK_EXTRA_ARGS
|
||||
value: {{ .Values.extraStartupArgs | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.adminRealm }}
|
||||
- name: KC_SPI_ADMIN_REALM
|
||||
value: "{{ .Values.adminRealm }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ printf "%s-env-vars" (include "common.names.fullname" .) }}
|
||||
{{- if .Values.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
|
||||
name: {{ tpl .Values.extraEnvVarsCM . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
|
||||
name: {{ tpl .Values.extraEnvVarsSecret . }}
|
||||
{{- end }}
|
||||
{{- if .Values.resources }}
|
||||
resources: {{- toYaml .Values.resources | nindent 12 }}
|
||||
@@ -285,40 +185,42 @@ spec:
|
||||
containerPort: {{ .Values.containerPorts.https }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if and (.Values.metrics.enabled) (not (eq (.Values.containerPorts.http | int) (.Values.containerPorts.metrics | int) )) }}
|
||||
- name: metrics
|
||||
containerPort: {{ .Values.containerPorts.metrics }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- name: management
|
||||
containerPort: {{ .Values.containerPorts.management }}
|
||||
protocol: TCP
|
||||
{{- end}}
|
||||
{{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
|
||||
- name: discovery
|
||||
containerPort: 7800
|
||||
{{- if .Values.extraContainerPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraContainerPorts "context" $) | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraContainerPorts "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" .) | nindent 12 }}
|
||||
{{- else if .Values.startupProbe.enabled }}
|
||||
startupProbe: {{- omit .Values.startupProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: {{ .Values.httpRelativePath }}
|
||||
port: http
|
||||
port: {{ ternary "http" "https" (or .Values.httpEnabled (not .Values.tls.enabled)) }}
|
||||
scheme: {{ ternary "HTTP" "HTTPS" (or .Values.httpEnabled (not .Values.tls.enabled)) }}
|
||||
{{- end }}
|
||||
{{- if .Values.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" .) | nindent 12 }}
|
||||
{{- else if .Values.livenessProbe.enabled }}
|
||||
livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: http
|
||||
port: {{ ternary "http" "https" (or .Values.httpEnabled (not .Values.tls.enabled)) }}
|
||||
{{- end }}
|
||||
{{- if .Values.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" .) | nindent 12 }}
|
||||
{{- else if .Values.readinessProbe.enabled }}
|
||||
readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: {{ .Values.httpRelativePath }}realms/{{ .Values.adminRealm | default "master" }}
|
||||
port: http
|
||||
port: {{ ternary "http" "https" (or .Values.httpEnabled (not .Values.tls.enabled)) }}
|
||||
scheme: {{ ternary "HTTP" "HTTPS" (or .Values.httpEnabled (not .Values.tls.enabled)) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
@@ -357,14 +259,9 @@ spec:
|
||||
mountPath: /opt/bitnami/keycloak/certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.customCaExistingSecret }}
|
||||
- name: custom-ca
|
||||
mountPath: /opt/bitnami/keycloak/custom-ca
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if .Values.spi.existingSecret }}
|
||||
- name: spi-certificates
|
||||
mountPath: /opt/bitnami/keycloak/spi-certs
|
||||
{{- if .Values.trustedCertsExistingSecret }}
|
||||
- name: truststore
|
||||
mountPath: /opt/bitnami/keycloak/truststore
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||
@@ -372,10 +269,10 @@ spec:
|
||||
mountPath: /docker-entrypoint-initdb.d
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
@@ -387,33 +284,17 @@ spec:
|
||||
- secret:
|
||||
name: {{ include "keycloak.secretName" . }}
|
||||
- secret:
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
name: {{ include "keycloak.database.secretName" . }}
|
||||
items:
|
||||
- key: {{ include "keycloak.databaseSecretPasswordKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.databaseSecretPasswordKey" .) }}
|
||||
{{- if .Values.externalDatabase.existingSecretHostKey }}
|
||||
- key: {{ include "keycloak.databaseSecretHostKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.databaseSecretHostKey" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretPortKey }}
|
||||
- key: {{ include "keycloak.databaseSecretPortKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.databaseSecretPortKey" .) }}
|
||||
{{- end }}
|
||||
- key: {{ include "keycloak.database.secretPasswordKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.database.secretPasswordKey" .) }}
|
||||
{{- if .Values.externalDatabase.existingSecretUserKey }}
|
||||
- key: {{ include "keycloak.databaseSecretUserKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.databaseSecretUserKey" .) }}
|
||||
- key: {{ include "keycloak.database.secretUserKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.database.secretUserKey" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.externalDatabase.existingSecretDatabaseKey }}
|
||||
- key: {{ include "keycloak.databaseSecretDatabaseKey" . }}
|
||||
path: {{ printf "db-%s" (include "keycloak.databaseSecretDatabaseKey" .) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.enabled (or .Values.tls.keystorePassword .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
|
||||
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated.enabled) (or .Values.tls.keystorePassword .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
|
||||
- secret:
|
||||
name: {{ include "keycloak.tlsPasswordsSecretName" . }}
|
||||
{{- end }}
|
||||
{{- if and .Values.spi.existingSecret (or .Values.spi.truststorePassword .Values.spi.passwordsSecret) }}
|
||||
- secret:
|
||||
name: {{ include "keycloak.spiPasswordsSecretName" . }}
|
||||
name: {{ include "keycloak.tls.passwordsSecretName" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||
@@ -424,26 +305,20 @@ spec:
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: certificates
|
||||
secret:
|
||||
secretName: {{ include "keycloak.tlsSecretName" . }}
|
||||
secretName: {{ include "keycloak.tls.secretName" . }}
|
||||
defaultMode: 420
|
||||
{{- end }}
|
||||
{{- if .Values.customCaExistingSecret }}
|
||||
- name: custom-ca
|
||||
{{- if .Values.trustedCertsExistingSecret }}
|
||||
- name: truststore
|
||||
secret:
|
||||
secretName: {{ .Values.customCaExistingSecret }}
|
||||
defaultMode: 420
|
||||
{{- end }}
|
||||
{{- if .Values.spi.existingSecret }}
|
||||
- name: spi-certificates
|
||||
secret:
|
||||
secretName: {{ .Values.spi.existingSecret }}
|
||||
secretName: {{ tpl .Values.trustedCertsExistingSecret . }}
|
||||
defaultMode: 420
|
||||
{{- end }}
|
||||
{{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
|
||||
- name: custom-init-scripts
|
||||
configMap:
|
||||
name: {{ include "keycloak.initdbScriptsCM" . }}
|
||||
name: {{ include "keycloak.initdbScripts.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -3,16 +3,17 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (or .Values.tls.keystorePassword .Values.tls.truststorePassword) (not .Values.tls.passwordsSecret) }}
|
||||
{{- if and (not .Values.tls.usePemCerts) (.Values.tls.autoGenerated.enabled) (not .Values.tls.passwordsSecret) (or .Values.tls.keystorePassword .Values.tls.truststorePassword) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-tls-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/component: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
@@ -22,22 +23,4 @@ data:
|
||||
{{- if .Values.tls.truststorePassword }}
|
||||
tls-truststore-password: {{ .Values.tls.truststorePassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- if and .Values.spi.truststorePassword (not .Values.spi.passwordsSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-spi-passwords" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- if .Values.spi.truststorePassword }}
|
||||
spi-truststore-password: {{ .Values.spi.truststorePassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -3,69 +3,28 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- if .Values.ingress.secrets }}
|
||||
{{- range .Values.ingress.secrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .name "context" $ ) }}
|
||||
namespace: {{ include "common.names.namespace" $ | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.tplvalues.render" ( dict "value" .certificate "context" $ ) | b64enc }}
|
||||
tls.key: {{ include "common.tplvalues.render" ( dict "value" .key "context" $ ) | b64enc }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
|
||||
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
|
||||
{{- $ca := genCA "keycloak-ca" 365 }}
|
||||
{{- $cert := genSignedCert (tpl .Values.ingress.hostname .) nil (list (tpl .Values.ingress.hostname .)) 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (include "keycloak.createTlsSecret" $) }}
|
||||
{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
|
||||
{{- if and .Values.tls.enabled .Values.tls.autoGenerated.enabled (eq .Values.tls.autoGenerated.engine "helm") -}}
|
||||
{{- $ca := genCA "keycloak-ca" 365 }}
|
||||
{{- $releaseNamespace := include "common.names.namespace" . }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
---
|
||||
{{- $headlessServiceName := include "keycloak.headless.serviceName" . }}
|
||||
{{- $serviceName := include "common.names.fullname" . }}
|
||||
{{- $altNames := list (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) $headlessServiceName (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $serviceName "127.0.0.1" "localhost" }}
|
||||
{{- $cert := genSignedCert $serviceName nil $altNames 365 $ca }}
|
||||
{{- $secretName := include "keycloak.tls.secretName" . }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $svcName := include "common.names.fullname" . }}
|
||||
{{- $altNames := list (printf "%s.%s.svc.%s" $svcName $releaseNamespace $clusterDomain) (printf "%s.%s" $svcName $releaseNamespace) $svcName }}
|
||||
{{- $cert := genSignedCert $svcName nil $altNames 365 $ca }}
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
|
||||
ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
|
||||
tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" .) }}
|
||||
tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" .) }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
45
charts/keycloak/templates/vpa.yaml
Normal file
45
charts/keycloak/templates/vpa.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and (include "common.capabilities.apiVersions.has" (dict "version" "autoscaling.k8s.io/v1/VerticalPodAutoscaler" "context" .)) .Values.autoscaling.vpa.enabled }}
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
app.kubernetes.io/part-of: keycloak
|
||||
{{- if or .Values.autoscaling.vpa.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" (dict "values" (list .Values.autoscaling.vpa.annotations .Values.commonAnnotations) "context" .) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
resourcePolicy:
|
||||
containerPolicies:
|
||||
- containerName: keycloak
|
||||
{{- with .Values.autoscaling.vpa.controlledResources }}
|
||||
controlledResources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.autoscaling.vpa.maxAllowed }}
|
||||
maxAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.autoscaling.vpa.minAllowed }}
|
||||
minAllowed:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
|
||||
kind: StatefulSet
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
{{- if .Values.autoscaling.vpa.updatePolicy }}
|
||||
updatePolicy:
|
||||
{{- with .Values.autoscaling.vpa.updatePolicy.updateMode }}
|
||||
updateMode: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user