apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: keycloak
  labels:
    app-name: keycloak
    version: "${KEYCLOAK_VERSION}"
    component: sso-server
    hostNetwork: "no"
    internal-service: "no"
    managed-by: chynten
    created-by: chynten
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app-name: keycloak
  template:
    metadata:
      labels:
        app-name: keycloak
    spec:
      containers:
      - name: keycloak
        image: ${KEYCLOAK_IMAGE}:${KEYCLOAK_VERSION}
        imagePullPolicy: IfNotPresent
        env:
        - name: KEYCLOAK_USER
          value: admin
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"
        - name: JAVA_OPTS
          value: "-server -Xms512m -Xmx768m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true   --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED"
        - name: KEYCLOAK_PASSWORD
          valueFrom:
            secretKeyRef:
              name: keycloak-secret
              key: keycloak-password
        volumeMounts:
          - name: data
            mountPath: /opt/jboss/keycloak/standalone/data
        readinessProbe:
          httpGet:
            path: /auth/realms/home
            port: 8080
            scheme: HTTP
          periodSeconds: 60
        livenessProbe:
          httpGet:
            path: /auth/realms/home
            port: 8080
            scheme: HTTP
          periodSeconds: 60
        startupProbe:
          httpGet:
            path: /auth/realms/home
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 30
          failureThreshold: 5
          periodSeconds: 10
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
      securityContext:
        fsGroup: 33
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: keycloak-data-pvc