apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: keycloak
    app.kubernetes.io/instance: builtin
    app.kubernetes.io/managed-by: commodore
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/version: 15.0.2
    helm.sh/chart: keycloak-10.3.1
  name: keycloak
spec:
  podManagementPolicy: Parallel
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/instance: keycloak
      app.kubernetes.io/name: keycloak
  serviceName: keycloak-headless
  template:
    metadata:
      annotations:
        checksum/config-startup: c6c620d6f92a0e8dc6c4ec68299a0cdb580b97df3191044d4b4d9668994aba51
        checksum/secrets: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
      labels:
        app.kubernetes.io/instance: keycloak
        app.kubernetes.io/name: keycloak
        keycloak-postgresql-client: 'true'
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/component
                  operator: NotIn
                  values:
                  - test
                matchLabels:
                  app.kubernetes.io/instance: keycloak
                  app.kubernetes.io/name: keycloak
              topologyKey: failure-domain.beta.kubernetes.io/zone
            weight: 100
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/component
                operator: NotIn
                values:
                - test
              matchLabels:
                app.kubernetes.io/instance: keycloak
                app.kubernetes.io/name: keycloak
            topologyKey: kubernetes.io/hostname
      containers:
      - args: []
        command: []
        env:
        - name: CACHE_OWNERS_AUTH_SESSIONS_COUNT
          value: '2'
        - name: CACHE_OWNERS_COUNT
          value: '2'
        - name: DB_ADDR
          value: patched
        - name: DB_DATABASE
          value: keycloak
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              key: postgresql-password
              name: keycloak-postgresql
        - name: DB_PORT
          value: '5432'
        - name: DB_USER
          value: keycloak
        - name: DB_VENDOR
          value: postgres
        - name: FOO
          value: bar
        - name: JAVA_OPTS
          value: -XX:+UseContainerSupport -XX:MaxRAMPercentage=50.0 -Djava.net.preferIPv4Stack=true
            -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS -Djava.awt.headless=true
        - name: JGROUPS_DISCOVERY_PROPERTIES
          value: dns_query=keycloak-headless.syn-builtin.svc.cluster.local
        - name: JGROUPS_DISCOVERY_PROTOCOL
          value: dns.DNS_PING
        - name: KEYCLOAK_STATISTICS
          value: all
        - name: PROXY_ADDRESS_FORWARDING
          value: 'true'
        envFrom:
        - secretRef:
            name: keycloak-admin-user
        - secretRef:
            name: keycloak-postgresql
        image: quay.io/keycloak/keycloak:15.0.2
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /auth/
            port: http
          initialDelaySeconds: 0
          timeoutSeconds: 5
        name: keycloak
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8443
          name: https
          protocol: TCP
        - containerPort: 9990
          name: http-management
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /auth/realms/master
            port: http
          initialDelaySeconds: 30
          timeoutSeconds: 1
        resources:
          limits:
            cpu: '1'
            memory: 1Gi
          requests:
            cpu: 500m
            memory: 512Mi
        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
        startupProbe:
          failureThreshold: 60
          httpGet:
            path: /auth/
            port: http
          initialDelaySeconds: 30
          periodSeconds: 5
          timeoutSeconds: 1
        volumeMounts:
        - mountPath: /opt/jboss/certs
          name: db-certs
          readOnly: true
        - mountPath: /etc/x509/https
          name: keycloak-tls
          readOnly: true
        - mountPath: /opt/jboss/startup-scripts/keycloak.cli
          name: startup
          readOnly: true
          subPath: keycloak.cli
        - mountPath: /opt/test
          name: theme
          readOnly: true
      enableServiceLinks: true
      initContainers:
      - command:
        - sh
        - -c
        - "echo 'Waiting for PostgreSQL to become ready...'\n\nuntil printf \".\"\
          \ && nc -z -w 2 keycloak-postgresql 5432; do\n    sleep 2;\ndone;\n\necho\
          \ 'PostgreSQL OK \u2713'\n"
        image: docker.io/busybox:1.32
        imagePullPolicy: IfNotPresent
        name: pgchecker
        resources:
          limits:
            cpu: 20m
            memory: 32Mi
          requests:
            cpu: 20m
            memory: 32Mi
        securityContext:
          allowPrivilegeEscalation: false
          runAsGroup: 1000
          runAsNonRoot: true
          runAsUser: 1000
      - args:
        - -c
        - |
          echo "Copying theme..."
          cp -R /theme/* /company-theme
        command:
        - sh
        image: company/keycloak-theme:v1.0.0
        imagePullPolicy: IfNotPresent
        name: theme-provider
        volumeMounts:
        - mountPath: /company-theme
          name: theme
      restartPolicy: Always
      securityContext:
        fsGroup: 1000
      serviceAccountName: keycloak
      terminationGracePeriodSeconds: 60
      volumes:
      - name: db-certs
        secret:
          defaultMode: 256
          items:
          - key: tls.crt
            path: tls.crt
          secretName: keycloak-postgresql-tls
      - name: keycloak-tls
        secret:
          defaultMode: 420
          secretName: keycloak-tls
      - configMap:
          defaultMode: 365
          items:
          - key: keycloak.cli
            path: keycloak.cli
          name: keycloak-startup
        name: startup
      - emptyDir: {}
        name: theme
  updateStrategy:
    type: RollingUpdate
