mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/keycloak] Chart standardized (#9333)
* [bitnami/keycloak] Chart standardized Signed-off-by: juan131 <juanariza@vmware.com> * [bitnami/keycloak] Update components versions Signed-off-by: Bitnami Containers <containers@bitnami.com> Co-authored-by: Bitnami Containers <containers@bitnami.com>
This commit is contained in:
Juan Ariza Toledano
co-authored by
Bitnami Containers
Bitnami Containers
parent
3d5945a08a
commit
8fb4fcd7f8
@@ -1,9 +1,9 @@
|
||||
dependencies:
|
||||
- name: postgresql
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 11.1.3
|
||||
version: 11.1.4
|
||||
- name: common
|
||||
repository: https://charts.bitnami.com/bitnami
|
||||
version: 1.11.3
|
||||
digest: sha256:59d28ebb1e7caa4862a9892c8eebf2f28e593292d756c5e48b4ec12d7e4c0571
|
||||
generated: "2022-03-04T15:38:25.331170061Z"
|
||||
digest: sha256:0fc4c1a4f98fe10a226266b775c3a3feec858336fce8bc89dc7502c680a9ad97
|
||||
generated: "2022-03-08T12:47:29.957618+01:00"
|
||||
|
||||
@@ -12,7 +12,7 @@ dependencies:
|
||||
tags:
|
||||
- bitnami-common
|
||||
version: 1.x.x
|
||||
description: Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.
|
||||
description: Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.
|
||||
engine: gotpl
|
||||
home: https://www.keycloak.org
|
||||
icon: https://bitnami.com/assets/stacks/keycloak/img/keycloak-stack-220x234.png
|
||||
@@ -26,4 +26,4 @@ name: keycloak
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-keycloak
|
||||
- https://github.com/keycloak/keycloak
|
||||
version: 7.0.3
|
||||
version: 7.1.0
|
||||
|
||||
+178
-156
@@ -2,12 +2,12 @@
|
||||
|
||||
# Keycloak packaged by Bitnami
|
||||
|
||||
Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.
|
||||
Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.
|
||||
|
||||
[Overview of Keycloak](https://www.keycloak.org/)
|
||||
|
||||
Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement.
|
||||
|
||||
|
||||
## TL;DR
|
||||
|
||||
```console
|
||||
@@ -61,18 +61,22 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` |
|
||||
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------- | -------------------------------------------------------------------- | --------------- |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `nameOverride` | String to partially override keycloak.fullname | `""` |
|
||||
| `fullnameOverride` | String to fully override keycloak.fullname | `""` |
|
||||
| `hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------ | --------------------------------------------------------------------------------------- | --------------- |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `nameOverride` | String to partially override keycloak.fullname | `""` |
|
||||
| `fullnameOverride` | String to fully override keycloak.fullname | `""` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the the statefulset | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the the statefulset | `["infinity"]` |
|
||||
|
||||
|
||||
### Keycloak parameters
|
||||
|
||||
@@ -80,7 +84,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| --------------------------------- | --------------------------------------------------------------------------------------------- | ---------------------- |
|
||||
| `image.registry` | Keycloak image registry | `docker.io` |
|
||||
| `image.repository` | Keycloak image repository | `bitnami/keycloak` |
|
||||
| `image.tag` | Keycloak image tag (immutable tags are recommended) | `16.1.0-debian-10-r0` |
|
||||
| `image.tag` | Keycloak image tag (immutable tags are recommended) | `16.1.1-debian-10-r36` |
|
||||
| `image.pullPolicy` | Keycloak image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `image.debug` | Specify if debug logs should be enabled | `false` |
|
||||
@@ -94,6 +98,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `auth.tls.enabled` | Enable TLS encryption | `false` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates. Currently only supports PEM certificates | `false` |
|
||||
| `auth.tls.existingSecret` | Existing secret containing the TLS certificates per Keycloak replica | `""` |
|
||||
| `auth.tls.usePem` | Use PEM certificates as input instead of PKS12/JKS stores | `false` |
|
||||
| `auth.tls.truststoreFilename` | Truststore specific filename inside the existing secret | `""` |
|
||||
| `auth.tls.keystoreFilename` | Keystore specific filename inside the existing secret | `""` |
|
||||
| `auth.tls.jksSecret` | DEPRECATED. Use `auth.tls.existingSecret` instead | `""` |
|
||||
@@ -119,14 +124,155 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` |
|
||||
|
||||
|
||||
### Keycloak statefulset parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------- |
|
||||
| `replicaCount` | Number of Keycloak replicas to deploy | `1` |
|
||||
| `containerPorts.http` | Keycloak HTTP container port | `8080` |
|
||||
| `containerPorts.https` | Keycloak HTTPS container port | `8443` |
|
||||
| `containerPorts.management` | Keycloak management HTTP container port | `9990` |
|
||||
| `podSecurityContext.enabled` | Enabled Keykloak pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroup` | Set Keykloak pod's Security Context fsGroup | `1001` |
|
||||
| `containerSecurityContext.enabled` | Enabled Keykloak containers' Security Context | `true` |
|
||||
| `containerSecurityContext.runAsUser` | Set Keykloak container's Security Context runAsUser | `1001` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set Keykloak container's Security Context runAsNonRoot | `true` |
|
||||
| `resources.limits` | The resources limits for the Keycloak containers | `{}` |
|
||||
| `resources.requests` | The requested resources for the Keycloak containers | `{}` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe on Keycloak containers | `true` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `300` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `1` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe on Keycloak containers | `true` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `startupProbe.enabled` | Enable startupProbe on Keycloak containers | `false` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `5` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `customLivenessProbe` | Custom Liveness probes for Keycloak | `{}` |
|
||||
| `customReadinessProbe` | Custom Rediness probes Keycloak | `{}` |
|
||||
| `customStartupProbe` | Custom Startup probes for Keycloak | `{}` |
|
||||
| `lifecycleHooks` | LifecycleHooks to set additional configuration at startup | `{}` |
|
||||
| `hostAliases` | Deployment pod host aliases | `[]` |
|
||||
| `podLabels` | Extra labels for Keycloak pods | `{}` |
|
||||
| `podAnnotations` | Annotations for Keycloak pods | `{}` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `{}` |
|
||||
| `podManagementPolicy` | Pod management policy for the Keycloak statefulset | `Parallel` |
|
||||
| `priorityClassName` | Keycloak pods' Priority Class Name | `""` |
|
||||
| `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` |
|
||||
| `terminationGracePeriodSeconds` | Seconds Keycloak pod needs to terminate gracefully | `""` |
|
||||
| `updateStrategy.type` | Keycloak statefulset strategy type | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate` | Keycloak statefulset rolling update configuration parameters | `{}` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes for Keycloak pods | `[]` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Keycloak container(s) | `[]` |
|
||||
| `initContainers` | Add additional init containers to the Keycloak pods | `[]` |
|
||||
| `sidecars` | Add additional sidecar containers to the Keycloak pods | `[]` |
|
||||
|
||||
|
||||
### Exposure parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `service.type` | Kubernetes service type | `LoadBalancer` |
|
||||
| `service.ports.http` | Keycloak service HTTP port | `80` |
|
||||
| `service.ports.https` | Keycloak service HTTPS port | `443` |
|
||||
| `service.nodePorts` | Specify the nodePort values for the LoadBalancer and NodePort service types. | `{}` |
|
||||
| `service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` |
|
||||
| `service.clusterIP` | Keycloak service clusterIP IP | `""` |
|
||||
| `service.loadBalancerIP` | loadBalancerIP for the SuiteCRM Service (optional, cloud specific) | `""` |
|
||||
| `service.loadBalancerSourceRanges` | Address that are allowed when service is LoadBalancer | `[]` |
|
||||
| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
|
||||
| `service.annotations` | Additional custom annotations for Keycloak service | `{}` |
|
||||
| `service.extraPorts` | Extra port to expose on Keycloak service | `[]` |
|
||||
| `ingress.enabled` | Enable ingress record generation for Keycloak | `false` |
|
||||
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `ingress.hostname` | Default host for the ingress record | `keycloak.local` |
|
||||
| `ingress.path` | Default path for the ingress record | `/` |
|
||||
| `ingress.servicePort` | Backend service port to use | `http` |
|
||||
| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` |
|
||||
| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
|
||||
| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` |
|
||||
| `ingress.extraPaths` | Any additional arbitrary paths that may need to be added to the ingress under the main host. | `[]` |
|
||||
| `ingress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
|
||||
| `ingress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
|
||||
| `networkPolicy.enabled` | Enable the default NetworkPolicy policy | `false` |
|
||||
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
|
||||
| `networkPolicy.additionalRules` | Additional NetworkPolicy rules | `{}` |
|
||||
|
||||
|
||||
### RBAC parameter
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | --------------------------------------------------------- | ------- |
|
||||
| `serviceAccount.create` | Enable the creation of a ServiceAccount for Keycloak pods | `true` |
|
||||
| `serviceAccount.name` | Name of the created ServiceAccount | `""` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Auto-mount the service account token in the pod | `false` |
|
||||
| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
|
||||
| `rbac.create` | Whether to create and use RBAC resources or not | `false` |
|
||||
| `rbac.rules` | Custom RBAC rules | `[]` |
|
||||
|
||||
|
||||
### Other parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | -------------------------------------------------------------- | ------- |
|
||||
| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `false` |
|
||||
| `pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `1` |
|
||||
| `pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `""` |
|
||||
| `autoscaling.enabled` | Enable autoscaling for Keycloak | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum number of Keycloak replicas | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum number of Keycloak replicas | `11` |
|
||||
| `autoscaling.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `autoscaling.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
|
||||
|
||||
### Metrics parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | ------------------------------------------------------------------------------------- | ------- |
|
||||
| `metrics.enabled` | Enable exposing Keycloak statistics | `false` |
|
||||
| `metrics.service.ports.http` | Metrics service HTTP port | `9990` |
|
||||
| `metrics.service.annotations` | Annotations for enabling prometheus to access the metrics endpoints | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped | `30s` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` |
|
||||
| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
|
||||
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
|
||||
| `metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` |
|
||||
| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` |
|
||||
|
||||
|
||||
### keycloak-config-cli parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ----------------------------- |
|
||||
| `keycloakConfigCli.enabled` | Whether to enable keycloak-config-cli | `false` |
|
||||
| `keycloakConfigCli.enabled` | Whether to enable keycloak-config-cli job | `false` |
|
||||
| `keycloakConfigCli.image.registry` | keycloak-config-cli container image registry | `docker.io` |
|
||||
| `keycloakConfigCli.image.repository` | keycloak-config-cli container image repository | `bitnami/keycloak-config-cli` |
|
||||
| `keycloakConfigCli.image.tag` | keycloak-config-cli container image tag | `4.5.0-debian-10-r8` |
|
||||
| `keycloakConfigCli.image.tag` | keycloak-config-cli container image tag | `4.7.0-debian-10-r14` |
|
||||
| `keycloakConfigCli.image.pullPolicy` | keycloak-config-cli container image pull policy | `IfNotPresent` |
|
||||
| `keycloakConfigCli.image.pullSecrets` | keycloak-config-cli container image pull secrets | `[]` |
|
||||
| `keycloakConfigCli.annotations` | Annotations for keycloak-config-cli job | `{}` |
|
||||
@@ -151,149 +297,25 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `keycloakConfigCli.configuration` | keycloak-config-cli realms configuration | `{}` |
|
||||
| `keycloakConfigCli.existingConfigmap` | ConfigMap with keycloak-config-cli configuration. This will override `keycloakConfigCli.config` | `""` |
|
||||
|
||||
### Keycloak deployment/statefulset parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | ----------------------------------------------------------------------------------------- | --------------------- |
|
||||
| `replicaCount` | Number of Keycloak replicas to deploy | `1` |
|
||||
| `podManagementPolicy` | Keycloak statefulSet podManagement policy | `Parallel` |
|
||||
| `containerPorts` | Keycloak container ports to open | `{}` |
|
||||
| `podSecurityContext.enabled` | Enabled Keykloak pods' Security Context | `true` |
|
||||
| `podSecurityContext.fsGroup` | Set Keykloak pod's Security Context fsGroup | `1001` |
|
||||
| `containerSecurityContext.enabled` | Enabled Keykloak containers' Security Context | `true` |
|
||||
| `containerSecurityContext.runAsUser` | Set Keykloak container's Security Context runAsUser | `1001` |
|
||||
| `containerSecurityContext.runAsNonRoot` | Set Keykloak container's Security Context runAsNonRoot | `true` |
|
||||
| `resources.limits` | The resources limits for the Keycloak container | `{}` |
|
||||
| `resources.requests` | The requested resources for the Keycloak container | `{}` |
|
||||
| `startupProbe.enabled` | Enable startupProbe | `false` |
|
||||
| `startupProbe.httpGet.path` | Request path for startupProbe | `/auth/` |
|
||||
| `startupProbe.httpGet.port` | Port for startupProbe | `http` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `5` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
|
||||
| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
|
||||
| `livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `livenessProbe.httpGet.path` | Request path for livenessProbe | `/auth/` |
|
||||
| `livenessProbe.httpGet.port` | Port for livenessProbe | `http` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `300` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `1` |
|
||||
| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` |
|
||||
| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `readinessProbe.enabled` | Enable readinessProbe | `true` |
|
||||
| `readinessProbe.httpGet.path` | Request path for readinessProbe | `/auth/realms/master` |
|
||||
| `readinessProbe.httpGet.port` | Port for readinessProbe | `http` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` |
|
||||
| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
|
||||
| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` |
|
||||
| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
|
||||
| `customStartupProbe` | Custom Startup probes for Keycloak | `{}` |
|
||||
| `customLivenessProbe` | Custom Liveness probes for Keycloak | `{}` |
|
||||
| `customReadinessProbe` | Custom Rediness probes Keycloak | `{}` |
|
||||
| `updateStrategy.type` | StrategyType | `RollingUpdate` |
|
||||
| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` |
|
||||
| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `affinity` | Affinity for pod assignment | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Tolerations for pod assignment | `[]` |
|
||||
| `podLabels` | Extra labels for Keycloak pods | `{}` |
|
||||
| `podAnnotations` | Annotations for Keycloak pods | `{}` |
|
||||
| `priorityClassName` | Keycloak pods' priority. | `""` |
|
||||
| `lifecycleHooks` | LifecycleHooks to set additional configuration at startup | `{}` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes for Keycloak pods | `[]` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Keycloak container(s) | `[]` |
|
||||
| `initContainers` | Add additional init containers to the Keycloak pods | `[]` |
|
||||
| `sidecars` | Add additional sidecar containers to the Keycloak pods | `[]` |
|
||||
|
||||
### Exposure parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `service.type` | Kubernetes service type | `LoadBalancer` |
|
||||
| `service.port` | Service HTTP port | `80` |
|
||||
| `service.httpsPort` | HTTPS Port | `443` |
|
||||
| `service.nodePorts` | Specify the nodePort values for the LoadBalancer and NodePort service types. | `{}` |
|
||||
| `service.clusterIP` | Keycloak service clusterIP IP | `""` |
|
||||
| `service.loadBalancerIP` | loadBalancerIP for the SuiteCRM Service (optional, cloud specific) | `""` |
|
||||
| `service.loadBalancerSourceRanges` | Address that are allowed when service is LoadBalancer | `[]` |
|
||||
| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
|
||||
| `service.annotations` | Annotations for Keycloak service | `{}` |
|
||||
| `ingress.enabled` | Enable ingress controller resource | `false` |
|
||||
| `ingress.hostname` | Default host for the ingress resource | `keycloak.local` |
|
||||
| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
|
||||
| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
|
||||
| `ingress.path` | Ingress path | `/` |
|
||||
| `ingress.pathType` | Ingress path type | `ImplementationSpecific` |
|
||||
| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
|
||||
| `ingress.tls` | Enable TLS configuration for the hostname defined at `ingress.hostname` parameter | `false` |
|
||||
| `ingress.extraHosts` | The list of additional hostnames to be covered with this ingress record. | `[]` |
|
||||
| `ingress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
|
||||
| `ingress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
|
||||
| `ingress.existingSecret` | It is you own the certificate as secret. | `""` |
|
||||
| `ingress.servicePort` | Service port to be used | `http` |
|
||||
| `networkPolicy.enabled` | Enable the default NetworkPolicy policy | `false` |
|
||||
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
|
||||
| `networkPolicy.additionalRules` | Additional NetworkPolicy rules | `{}` |
|
||||
|
||||
### RBAC parameter
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | --------------------------------------------------------- | ------- |
|
||||
| `serviceAccount.create` | Enable the creation of a ServiceAccount for Keycloak pods | `true` |
|
||||
| `serviceAccount.name` | Name of the created ServiceAccount | `""` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Auto-mount the service account token in the pod | `false` |
|
||||
| `rbac.create` | Whether to create and use RBAC resources or not | `false` |
|
||||
| `rbac.rules` | Custom RBAC rules | `[]` |
|
||||
|
||||
### Other parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | -------------------------------------------------------------- | ------- |
|
||||
| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `false` |
|
||||
| `pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `1` |
|
||||
| `pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `""` |
|
||||
| `autoscaling.enabled` | Enable autoscaling for Keycloak | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum number of Keycloak replicas | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum number of Keycloak replicas | `11` |
|
||||
| `autoscaling.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `autoscaling.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
|
||||
### Metrics parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------- | ---------------------------------------------------------------------------- | ------- |
|
||||
| `metrics.enabled` | Enable exposing Keycloak statistics | `false` |
|
||||
| `metrics.service.port` | Service HTTP management port | `9990` |
|
||||
| `metrics.service.annotations` | Annotations for enabling prometheus to access the metrics endpoints | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped | `30s` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.relabellings` | Specify Metric Relabellings to add to the scrape endpoint | `[]` |
|
||||
| `metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels | `false` |
|
||||
| `metrics.serviceMonitor.additionalLabels` | Used to pass Labels that are required by the installed Prometheus Operator | `{}` |
|
||||
|
||||
### Database parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------- | ----------------------------------------------------------------------------- | ------------------ |
|
||||
| `postgresql.enabled` | Deploy a PostgreSQL server to satisfy the applications database requirements | `true` |
|
||||
| `postgresql.auth.username` | Keycloak PostgreSQL user (has superuser privileges if username is `postgres`) | `bn_keycloak` |
|
||||
| `postgresql.auth.password` | Keycloak PostgreSQL password - ignored if existingSecret is provided | `""` |
|
||||
| `postgresql.auth.database` | Name of the database to create | `bitnami_keycloak` |
|
||||
| `postgresql.auth.existingSecret` | Use an existing secret file with the PostgreSQL password | `""` |
|
||||
| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using PVC | `true` |
|
||||
| `externalDatabase.host` | Host of the external database | `""` |
|
||||
| `externalDatabase.port` | Database port | `5432` |
|
||||
| `externalDatabase.user` | non admin username for Keycloak Database | `bn_keycloak` |
|
||||
| `externalDatabase.password` | Database password | `""` |
|
||||
| `externalDatabase.database` | Database name | `bitnami_keycloak` |
|
||||
| `externalDatabase.existingSecret` | Use an existing secret file with the external PostgreSQL credentials | `""` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | ----------------------------------------------------------------------- | ------------------ |
|
||||
| `postgresql.enabled` | Switch to enable or disable the PostgreSQL helm chart | `true` |
|
||||
| `postgresql.auth.username` | Name for a custom user to create | `bn_keycloak` |
|
||||
| `postgresql.auth.password` | Password for the custom user to create | `""` |
|
||||
| `postgresql.auth.database` | Name for a custom database to create | `bitnami_keycloak` |
|
||||
| `postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials | `""` |
|
||||
| `postgresql.architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` |
|
||||
| `externalDatabase.host` | Database host | `""` |
|
||||
| `externalDatabase.port` | Database port number | `5432` |
|
||||
| `externalDatabase.user` | Non-root username for Keycloak | `bn_keycloak` |
|
||||
| `externalDatabase.password` | Password for the non-root username for Keycloak | `""` |
|
||||
| `externalDatabase.database` | Keycloak database name | `bitnami_keycloak` |
|
||||
| `externalDatabase.existingSecret` | Name of an existing secret resource containing the database credentials | `""` |
|
||||
| `externalDatabase.existingSecretPasswordKey` | Name of an existing secret key containing the database credentials | `""` |
|
||||
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
@@ -418,4 +440,4 @@ Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
limitations under the License.
|
||||
@@ -6,7 +6,7 @@ APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
Keycloak can be accessed through the following DNS name from within your cluster:
|
||||
|
||||
{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} (port {{ .Values.service.port }})
|
||||
{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} (port {{ coalesce .Values.service.ports.http .Values.service.port }})
|
||||
|
||||
To access Keycloak from outside the cluster execute the following commands:
|
||||
|
||||
@@ -63,8 +63,9 @@ You can access the Prometheus metrics following the steps below:
|
||||
|
||||
1. Get the Keycloak Prometheus metrics URL by running:
|
||||
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ printf "%s-metrics" (include "keycloak.fullname" .) }} {{ .Values.metrics.service.port }}:{{ .Values.metrics.service.port }} &
|
||||
echo "Keycloak Prometheus metrics URL: http://127.0.0.1:{{ .Values.metrics.service.port }}/metrics"
|
||||
{{- $metricsPort := coalesce .Values.metrics.service.ports.http .Values.metrics.service.port | toString }}
|
||||
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ printf "%s-metrics" (include "keycloak.fullname" .) }} {{ $metricsPort }}:{{ $metricsPort }} &
|
||||
echo "Keycloak Prometheus metrics URL: http://127.0.0.1:{{ $metricsPort }}/metrics"
|
||||
|
||||
2. Open a browser and access Keycloak Prometheus metrics using the obtained URL.
|
||||
|
||||
|
||||
@@ -172,6 +172,25 @@ Return the Database encrypted password
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Add environment variables to configure database values
|
||||
*/}}
|
||||
{{- define "keycloak.databaseSecretKey" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- print "password" -}}
|
||||
{{- else -}}
|
||||
{{- if .Values.externalDatabase.existingSecret -}}
|
||||
{{- if .Values.externalDatabase.existingSecretPasswordKey -}}
|
||||
{{- printf "%s" .Values.externalDatabase.existingSecretPasswordKey -}}
|
||||
{{- else -}}
|
||||
{{- print "password" -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- print "password" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Keycloak initdb scripts configmap
|
||||
*/}}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-headless" (include "keycloak.fullname" .) }}
|
||||
name: {{ printf "%s-headless" (include "keycloak.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
@@ -16,12 +16,12 @@ spec:
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
port: {{ coalesce .Values.service.ports.http .Values.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
{{- if .Values.auth.tls.enabled }}
|
||||
- name: https
|
||||
port: 443
|
||||
port: {{ coalesce .Values.service.ports.https .Values.service.httpsPort }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
{{- end }}
|
||||
|
||||
@@ -22,7 +22,7 @@ spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http-management
|
||||
port: {{ .Values.metrics.service.port }}
|
||||
port: {{ coalesce .Values.metrics.service.ports.http .Values.metrics.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: http-management
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
|
||||
@@ -22,7 +22,7 @@ spec:
|
||||
- port: {{ .Values.containerPorts.https }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
- port: 9990
|
||||
- port: {{ .Values.containerPorts.management }}
|
||||
{{- end }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
|
||||
@@ -19,21 +19,24 @@ metadata:
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
sessionAffinity: {{ .Values.service.sessionAffinity }}
|
||||
{{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if (or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort")) }}
|
||||
externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{ if eq .Values.service.type "LoadBalancer" }}
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
|
||||
{{ end }}
|
||||
{{- if (and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP))) }}
|
||||
{{- end }}
|
||||
{{- if not (empty .Values.service.loadBalancerIP) }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
port: {{ coalesce .Values.service.ports.http .Values.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.http))) }}
|
||||
@@ -42,7 +45,7 @@ spec:
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
- name: https
|
||||
port: {{ .Values.service.httpsPort }}
|
||||
port: {{ coalesce .Values.service.ports.https .Values.service.httpsPort }}
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
{{- if (and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.https))) }}
|
||||
@@ -50,5 +53,8 @@ spec:
|
||||
{{- else if eq .Values.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
|
||||
@@ -9,8 +9,14 @@ metadata:
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.serviceAccount.annotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
|
||||
@@ -3,15 +3,11 @@ apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "keycloak.fullname" . }}
|
||||
{{- if .Values.metrics.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
app.kubernetes.io/component: keycloak
|
||||
{{- if .Values.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $) | nindent 4 }}
|
||||
{{- if .Values.metrics.serviceMonitor.labels }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.labels "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
@@ -20,6 +16,9 @@ metadata:
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.metrics.serviceMonitor.jobLabel }}
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- port: http-management
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
@@ -28,16 +27,22 @@ spec:
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabellings }}
|
||||
metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.relabellings | nindent 6 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ .Release.Namespace }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- end }}
|
||||
|
||||
@@ -13,9 +13,11 @@ metadata:
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
||||
serviceName: {{ printf "%s-headless" (include "keycloak.fullname" .) }}
|
||||
serviceName: {{ printf "%s-headless" (include "keycloak.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
updateStrategy:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
|
||||
selector:
|
||||
@@ -59,12 +61,21 @@ spec:
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.podSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if or .Values.initContainers .Values.auth.tls.enabled }}
|
||||
initContainers:
|
||||
{{- if .Values.auth.tls.enabled }}
|
||||
@@ -170,10 +181,14 @@ spec:
|
||||
{{- if .Values.containerSecurityContext.enabled }}
|
||||
securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.command }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.args }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
@@ -212,7 +227,7 @@ spec:
|
||||
key: {{ include "common.secrets.key" (dict "existingSecret" .Values.auth.existingSecretPerPassword "key" "databasePassword") }}
|
||||
{{- else }}
|
||||
name: {{ include "keycloak.databaseSecretName" . }}
|
||||
key: "password"
|
||||
key: {{ include "keycloak.databaseSecretKey" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth.tls.enabled }}
|
||||
{{- if or .Values.auth.tls.keystorePassword .Values.auth.existingSecretPerPassword }}
|
||||
@@ -273,23 +288,34 @@ spec:
|
||||
containerPort: {{ .Values.containerPorts.https }}
|
||||
protocol: TCP
|
||||
- name: http-management
|
||||
containerPort: 9990
|
||||
containerPort: {{ .Values.containerPorts.management }}
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.startupProbe.enabled }}
|
||||
startupProbe: {{- omit .Values.startupProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: /auth/
|
||||
port: http
|
||||
{{- else if .Values.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.livenessProbe.enabled }}
|
||||
livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: /auth/
|
||||
port: http
|
||||
{{- else if .Values.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.readinessProbe.enabled }}
|
||||
readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
|
||||
httpGet:
|
||||
path: /auth/realms/master
|
||||
port: http
|
||||
{{- else if .Values.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if or .Values.configuration .Values.existingConfigmap }}
|
||||
- name: keycloak-config
|
||||
|
||||
+531
-548
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user