apiVersion: apps/v1
kind: Deployment
metadata:
  name: monitoring-oauth2-proxy
  namespace: monitoring
  labels:
    app: monitoring-oauth2-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: monitoring-oauth2-proxy
  template:
    metadata:
      labels:
        app: monitoring-oauth2-proxy
    spec:
      containers:
      - name: monitoring-oauth2-proxy
        image: crownlabs/oauth2-proxy:v6.0.0-crown
        imagePullPolicy: Always
        ports:
        - containerPort: 4180
          protocol: TCP
        args:
        # General configurations
        - --http-address=0.0.0.0:4180
        - --reverse-proxy=true
        # Cookie configurations
        - --cookie-secret=<cookie-secret>
        - --cookie-expire=3h
        # Omitting, since it does not work with the keycloak provider and conflicts with --sesion-cookie-minimal
        # - --cookie-refresh=2h
        # Use Keycloak as provider
        - --provider=keycloak
        # Client configuration in Keycloak (ID and Secret)
        - --client-id=monitoring
        - --client-secret=<monitoring-secret>
        # Keycloak URLs
        - --login-url=https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/auth
        - --redeem-url=https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/token
        - --validate-url=https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/userinfo
        # Restrictions
        - --keycloak-group=/monitoring
        - --email-domain=*
        - --session-cookie-minimal=true
        resources:
          requests:
            cpu: "10m"
            memory: 25Mi
          limits:
            cpu: "50m"
            memory: 100Mi
