Gitiles
Code Review Sign In
review.vexxhost.dev / atmosphere / refs/heads/stable/2024.2 / . / charts / keycloak / templates / statefulset.yaml
blob: 93857b60fd98fd5ae08547bfbfd985539a5014e2 [file] [log] [blame]
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]1{{- /*
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]2Copyright Broadcom, Inc. All Rights Reserved.
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]3SPDX-License-Identifier: APACHE-2.0
4*/}}
5
6apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
7kind: StatefulSet
8metadata:
9 name: {{ template "common.names.fullname" . }}
10 namespace: {{ include "common.names.namespace" . | quote }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]11 labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]12 app.kubernetes.io/component: keycloak
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]13 {{- if or .Values.statefulsetAnnotations .Values.commonAnnotations }}
14 annotations: {{- include "common.tplvalues.merge" ( dict "values" ( list .Values.statefulsetAnnotations .Values.commonAnnotations ) "context" $ ) | nindent 4 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]15 {{- end }}
16spec:
17 {{- if not .Values.autoscaling.enabled }}
18 replicas: {{ .Values.replicaCount }}
19 {{- end }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]20 revisionHistoryLimit: {{ .Values.revisionHistoryLimitCount }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]21 podManagementPolicy: {{ .Values.podManagementPolicy }}
22 serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
23 updateStrategy:
24 {{- include "common.tplvalues.render" (dict "value" .Values.updateStrategy "context" $ ) | nindent 4 }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]25 {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]26 selector:
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]27 matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]28 app.kubernetes.io/component: keycloak
29 template:
30 metadata:
31 annotations:
32 checksum/configmap-env-vars: {{ include (print $.Template.BasePath "/configmap-env-vars.yaml") . | sha256sum }}
33 {{- if not .Values.auth.existingSecret }}
34 checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
35 {{- end }}
36 {{- if (include "keycloak.createConfigmap" .) }}
37 checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
38 {{- end }}
39 {{- if .Values.podAnnotations }}
40 {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
41 {{- end }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]42 labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]43 app.kubernetes.io/component: keycloak
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]44 spec:
45 serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
46 {{- include "keycloak.imagePullSecrets" . | nindent 6 }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]47 automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]48 {{- if .Values.hostAliases }}
49 hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
50 {{- end }}
51 {{- if .Values.affinity }}
52 affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.affinity "context" $) | nindent 8 }}
53 {{- else }}
54 affinity:
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]55 podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
56 podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]57 nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
58 {{- end }}
59 {{- if .Values.nodeSelector }}
60 nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
61 {{- end }}
62 {{- if .Values.tolerations }}
63 tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
64 {{- end }}
65 {{- if .Values.topologySpreadConstraints }}
66 topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }}
67 {{- end }}
68 {{- if .Values.priorityClassName }}
69 priorityClassName: {{ .Values.priorityClassName | quote }}
70 {{- end }}
71 {{- if .Values.schedulerName }}
72 schedulerName: {{ .Values.schedulerName }}
73 {{- end }}
74 {{- if .Values.podSecurityContext.enabled }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]75 securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.podSecurityContext "context" $) | nindent 8 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]76 {{- end }}
77 {{- if .Values.dnsPolicy }}
78 dnsPolicy: {{ .Values.dnsPolicy }}
79 {{- end }}
80 {{- if .Values.dnsConfig }}
81 dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.dnsConfig "context" .) | nindent 8 }}
82 {{- end }}
83 {{- if semverCompare ">= 1.13" (include "common.capabilities.kubeVersion" .) }}
84 enableServiceLinks: {{ .Values.enableServiceLinks }}
85 {{- end }}
86 {{- if .Values.terminationGracePeriodSeconds }}
87 terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
88 {{- end }}
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]89 {{- if or .Values.enableDefaultInitContainers .Values.initContainers }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]90 initContainers:
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]91 {{- if .Values.enableDefaultInitContainers }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]92 - name: init-quarkus-directory
93 image: {{ template "keycloak.image" . }}
94 imagePullPolicy: {{ .Values.image.pullPolicy }}
95 command:
96 - /bin/bash
97 args:
98 - -ec
99 - |
100 #!/bin/bash
101 cp -r /opt/bitnami/keycloak/lib/quarkus/* /quarkus
102 {{- if .Values.containerSecurityContext.enabled }}
103 securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
104 {{- end }}
105 {{- if .Values.resources }}
106 resources: {{- toYaml .Values.resources | nindent 12 }}
107 {{- else if ne .Values.resourcesPreset "none" }}
108 resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
109 {{- end }}
110 volumeMounts:
111 - name: empty-dir
112 mountPath: /tmp
113 subPath: tmp-dir
114 - name: empty-dir
115 mountPath: /quarkus
116 subPath: app-quarkus-dir
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]117 {{- end }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]118 {{- if .Values.initContainers }}
119 {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
120 {{- end }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]121 {{- end }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]122 containers:
123 - name: keycloak
124 image: {{ template "keycloak.image" . }}
125 imagePullPolicy: {{ .Values.image.pullPolicy }}
126 {{- if .Values.lifecycleHooks }}
127 lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
128 {{- end }}
129 {{- if .Values.containerSecurityContext.enabled }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]130 securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) | nindent 12 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]131 {{- end }}
132 {{- if .Values.diagnosticMode.enabled }}
133 command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
134 {{- else if .Values.command }}
135 command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
136 {{- end }}
137 {{- if .Values.diagnosticMode.enabled }}
138 args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
139 {{- else if .Values.args }}
140 args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
141 {{- end }}
142 env:
143 - name: KUBERNETES_NAMESPACE
144 valueFrom:
145 fieldRef:
146 apiVersion: v1
147 fieldPath: metadata.namespace
148 - name: BITNAMI_DEBUG
149 value: {{ ternary "true" "false" .Values.image.debug | quote }}
150 - name: KEYCLOAK_ADMIN_PASSWORD
151 valueFrom:
152 secretKeyRef:
153 name: {{ include "keycloak.secretName" . }}
154 key: {{ include "keycloak.secretKey" . }}
155 - name: KEYCLOAK_DATABASE_PASSWORD
156 valueFrom:
157 secretKeyRef:
158 name: {{ include "keycloak.databaseSecretName" . }}
159 key: {{ include "keycloak.databaseSecretPasswordKey" . }}
160 {{- if .Values.externalDatabase.existingSecretHostKey }}
161 - name: KEYCLOAK_DATABASE_HOST
162 valueFrom:
163 secretKeyRef:
164 name: {{ include "keycloak.databaseSecretName" . }}
165 key: {{ include "keycloak.databaseSecretHostKey" . }}
166 {{- end }}
167 {{- if .Values.externalDatabase.existingSecretPortKey }}
168 - name: KEYCLOAK_DATABASE_PORT
169 valueFrom:
170 secretKeyRef:
171 name: {{ include "keycloak.databaseSecretName" . }}
172 key: {{ include "keycloak.databaseSecretPortKey" . }}
173 {{- end }}
174 {{- if .Values.externalDatabase.existingSecretUserKey }}
175 - name: KEYCLOAK_DATABASE_USER
176 valueFrom:
177 secretKeyRef:
178 name: {{ include "keycloak.databaseSecretName" . }}
179 key: {{ include "keycloak.databaseSecretUserKey" . }}
180 {{- end }}
181 {{- if .Values.externalDatabase.existingSecretDatabaseKey }}
182 - name: KEYCLOAK_DATABASE_NAME
183 valueFrom:
184 secretKeyRef:
185 name: {{ include "keycloak.databaseSecretName" . }}
186 key: {{ include "keycloak.databaseSecretDatabaseKey" . }}
187 {{- end }}
188 {{- if and .Values.tls.enabled (or .Values.tls.keystorePassword .Values.tls.passwordsSecret) }}
189 - name: KEYCLOAK_HTTPS_KEY_STORE_PASSWORD
190 valueFrom:
191 secretKeyRef:
192 name: {{ include "keycloak.tlsPasswordsSecretName" . }}
193 key: "tls-keystore-password"
194 {{- end }}
195 {{- if and .Values.tls.enabled (or .Values.tls.truststorePassword .Values.tls.passwordsSecret) }}
196 - name: KEYCLOAK_HTTPS_TRUST_STORE_PASSWORD
197 valueFrom:
198 secretKeyRef:
199 name: {{ include "keycloak.tlsPasswordsSecretName" . }}
200 key: "tls-truststore-password"
201 {{- end }}
202 {{- if and .Values.spi.existingSecret (or .Values.spi.truststorePassword .Values.spi.passwordsSecret) }}
203 - name: KEYCLOAK_SPI_TRUSTSTORE_PASSWORD
204 valueFrom:
205 secretKeyRef:
206 name: {{ include "keycloak.spiPasswordsSecretName" . }}
207 key: "spi-truststore-password"
208 {{- end }}
209 - name: KEYCLOAK_HTTP_RELATIVE_PATH
210 value: {{ .Values.httpRelativePath | quote }}
211 {{- if .Values.extraStartupArgs }}
212 - name: KEYCLOAK_EXTRA_ARGS
213 value: {{ .Values.extraStartupArgs | quote }}
214 {{- end }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]215 {{- if .Values.adminIngress.enabled }}
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]216 - name: KC_HOSTNAME_ADMIN_URL
217 value: "http{{ if .Values.adminIngress.tls }}s{{ end }}://{{ include "common.tplvalues.render" (dict "value" .Values.adminIngress.hostname "context" $) }}"
218 {{- end }}
219 {{- if and .Values.adminIngress.enabled (not .Values.ingress.enabled) }}
220 - name: KC_HOSTNAME_URL
221 value: "http{{ if .Values.adminIngress.tls }}s{{ end }}://{{ include "common.tplvalues.render" (dict "value" .Values.adminIngress.hostname "context" $) }}"
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]222 {{- end }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]223 {{- if .Values.extraEnvVars }}
224 {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
225 {{- end }}
226 envFrom:
227 - configMapRef:
228 name: {{ printf "%s-env-vars" (include "common.names.fullname" .) }}
229 {{- if .Values.extraEnvVarsCM }}
230 - configMapRef:
231 name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
232 {{- end }}
233 {{- if .Values.extraEnvVarsSecret }}
234 - secretRef:
235 name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
236 {{- end }}
237 {{- if .Values.resources }}
238 resources: {{- toYaml .Values.resources | nindent 12 }}
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]239 {{- else if ne .Values.resourcesPreset "none" }}
240 resources: {{- include "common.resources.preset" (dict "type" .Values.resourcesPreset) | nindent 12 }}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]241 {{- end }}
242 ports:
243 - name: http
244 containerPort: {{ .Values.containerPorts.http }}
245 protocol: TCP
246 {{- if .Values.tls.enabled }}
247 - name: https
248 containerPort: {{ .Values.containerPorts.https }}
249 protocol: TCP
250 {{- end }}
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]251 {{- /* Constant in code: https://github.com/keycloak/keycloak/blob/ce8e925c1ad9bf7a3180d1496e181aeea0ab5f8a/operator/src/main/java/org/keycloak/operator/Constants.java#L60 */}}
252 - name: discovery
253 containerPort: 7800
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]254 {{- if .Values.extraContainerPorts }}
255 {{- include "common.tplvalues.render" (dict "value" .Values.extraContainerPorts "context" $) | nindent 12 }}
256 {{- end }}
257 {{- if not .Values.diagnosticMode.enabled }}
258 {{- if .Values.customStartupProbe }}
259 startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
260 {{- else if .Values.startupProbe.enabled }}
261 startupProbe: {{- omit .Values.startupProbe "enabled" | toYaml | nindent 12 }}
262 httpGet:
263 path: {{ .Values.httpRelativePath }}
264 port: http
265 {{- end }}
266 {{- if .Values.customLivenessProbe }}
267 livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
268 {{- else if .Values.livenessProbe.enabled }}
269 livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
Mohammed Naser7d1623e2024-06-17 09:12:39 -0400[diff] [blame]270 tcpSocket:
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]271 port: http
272 {{- end }}
273 {{- if .Values.customReadinessProbe }}
274 readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
275 {{- else if .Values.readinessProbe.enabled }}
276 readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
277 httpGet:
278 path: {{ .Values.httpRelativePath }}realms/master
279 port: http
280 {{- end }}
281 {{- end }}
282 volumeMounts:
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]283 - name: empty-dir
284 mountPath: /tmp
285 subPath: tmp-dir
286 - name: empty-dir
287 mountPath: /opt/bitnami/keycloak/conf
288 subPath: app-conf-dir
289 - name: empty-dir
290 mountPath: /opt/bitnami/keycloak/lib/quarkus
291 subPath: app-quarkus-dir
292 - name: empty-dir
293 mountPath: /opt/bitnami/keycloak/data
294 subPath: app-data-dir
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]295 {{- if or .Values.configuration .Values.existingConfigmap }}
296 - name: keycloak-config
297 mountPath: /bitnami/keycloak/conf/keycloak.conf
298 subPath: keycloak.conf
299 {{- end }}
300 {{- if .Values.tls.enabled }}
301 - name: certificates
302 mountPath: /opt/bitnami/keycloak/certs
303 readOnly: true
304 {{- end }}
305 {{- if .Values.spi.existingSecret }}
306 - name: spi-certificates
307 mountPath: /opt/bitnami/keycloak/spi-certs
308 readOnly: true
309 {{- end }}
310 {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
311 - name: custom-init-scripts
312 mountPath: /docker-entrypoint-initdb.d
313 {{- end }}
314 {{- if .Values.extraVolumeMounts }}
315 {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
316 {{- end }}
317 {{- if .Values.sidecars }}
318 {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }}
319 {{- end }}
320 volumes:
Mohammed Naser65cda132024-05-02 14:34:08 -0400[diff] [blame]321 - name: empty-dir
322 emptyDir: {}
Oleksandr Kozachenkob0093492023-09-06 21:43:47 +0200[diff] [blame]323 {{- if or .Values.configuration .Values.existingConfigmap }}
324 - name: keycloak-config
325 configMap:
326 name: {{ include "keycloak.configmapName" . }}
327 {{- end }}
328 {{- if .Values.tls.enabled }}
329 - name: certificates
330 secret:
331 secretName: {{ include "keycloak.tlsSecretName" . }}
332 defaultMode: 420
333 {{- end }}
334 {{- if .Values.spi.existingSecret }}
335 - name: spi-certificates
336 secret:
337 secretName: {{ .Values.spi.existingSecret }}
338 defaultMode: 420
339 {{- end }}
340 {{- if or .Values.initdbScriptsConfigMap .Values.initdbScripts }}
341 - name: custom-init-scripts
342 configMap:
343 name: {{ include "keycloak.initdbScriptsCM" . }}
344 {{- end }}
345 {{- if .Values.extraVolumes }}
346 {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
347 {{- end }}