apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: keycloak
  namespace: keycloak
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
      component: keycloak
  serviceName: keycloak
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
  template:
    metadata:
      labels:
        app: keycloak
        component: keycloak
    spec:
      containers:
      - name: keycloak
        image: jboss/keycloak:10.0.1
        imagePullPolicy: IfNotPresent
        command: [ "/scripts/keycloak.sh" ]
        resources:
          requests:
            memory: 2Gi
          limits:
            memory: 2Gi
        env:
        - name: KEYCLOAK_USER
          value: keycloak
        - name: JAVA_OPTS
          value: "-Xmx1024m"
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"
        - name: KEYCLOAK_PASSWORD
          valueFrom:
            secretKeyRef:
              key: password
              name: keycloak-admin-user
        - name: DB_VENDOR
          value: h2
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /auth/
            port: http
            scheme: HTTP
          initialDelaySeconds: 120
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8443
          name: https
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /auth/
            port: http
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: /scripts
          name: scripts
        - mountPath: /opt/jboss/keycloak/standalone/data
          name: data
      restartPolicy: Always
      securityContext:
        fsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
      terminationGracePeriodSeconds: 60
      volumes:
      - configMap:
          defaultMode: 365
          name: keycloak
        name: scripts
