apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: enmasse
  name: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: enmasse
      name: keycloak
  template:
    metadata:
      labels:
        app: enmasse
        name: keycloak
    spec:
      containers:
      - env:
        - name: JAVA_OPTS_APPEND
          value: -Dvertx.cacheDirBase=/tmp -Djboss.bind.address=0.0.0.0 -Djava.net.preferIPv4Stack=true
        - name: SSO_ADMIN_USERNAME
          valueFrom:
            secretKeyRef:
              key: admin.username
              name: keycloak-credentials
        - name: SSO_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              key: admin.password
              name: keycloak-credentials
        - name: KEYCLOAK_SASL_XOAUTH_BASE_URI
          valueFrom:
            configMapKeyRef:
              key: oauthUrl
              name: keycloak-config
              optional: true
        - name: DB_DATABASE
          valueFrom:
            secretKeyRef:
              key: database-name
              name: postgresql
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              key: database-user
              name: postgresql
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              key: database-password
              name: postgresql
        image: redhat-sso-7/sso72-openshift:1.1
        livenessProbe:
          httpGet:
            path: /auth
            port: https
            scheme: HTTPS
          initialDelaySeconds: 60
        readinessProbe:
          httpGet:
            path: /auth
            port: https
            scheme: HTTPS
          initialDelaySeconds: 30
        name: keycloak
        ports:
        - containerPort: 5671
          name: amqps
        - containerPort: 8443
          name: https
        resources:
          limits:
            memory: 2Gi
        volumeMounts:
        - mountPath: /opt/eap/providers
          name: keycloak-providers
          readOnly: false
        - mountPath: /opt/eap/standalone/configuration
          name: keycloak-configuration
          readOnly: false
        - mountPath: /opt/enmasse/cert
          name: standard-authservice-cert
          readOnly: false
        - mountPath: /opt/eap/standalone/data
          name: keycloak-persistence
          readOnly: false
      initContainers:
      - env:
        - name: KEYCLOAK_DIR
          value: /opt/eap
        image: rh-amqmaas-1-tech-preview/amqmaas10-auth-plugin-openshift:1.0
        name: keycloak-plugin
        volumeMounts:
        - mountPath: /opt/eap/providers
          name: keycloak-providers
          readOnly: false
        - mountPath: /opt/eap/standalone/configuration
          name: keycloak-configuration
          readOnly: false
        - mountPath: /opt/enmasse/cert
          name: standard-authservice-cert
          readOnly: false
      volumes:
      - name: standard-authservice-cert
        secret:
          secretName: standard-authservice-cert
      - name: keycloak-persistence
        persistentVolumeClaim:
          claimName: keycloak-data
      - emptyDir: {}
        name: keycloak-configuration
      - emptyDir: {}
        name: keycloak-providers
