| # SPDX-FileCopyrightText: 2023-present Intel Corporation |
| # |
| # SPDX-License-Identifier: Apache-2.0 |
| |
| # Overrides of the Keycloak Helm chart - see [here](https://github.com/bitnami/charts/tree/main/bitnami/keycloak/#installing-the-chart) |
| # for documentation |
| global: |
| imageRegistry: "" |
| ## E.g. |
| ## imagePullSecrets: |
| ## - myRegistryKeySecretName |
| ## |
| imagePullSecrets: [ ] |
| storageClass: "" |
| |
| ## @section Common parameters |
| ## |
| |
| ## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) |
| ## |
| kubeVersion: "" |
| ## @param nameOverride String to partially override common.names.fullname |
| ## |
| nameOverride: "" |
| ## @param fullnameOverride String to fully override common.names.fullname |
| ## |
| fullnameOverride: "" |
| ## @param namespaceOverride String to fully override common.names.namespace |
| ## |
| namespaceOverride: "" |
| ## @param commonLabels Labels to add to all deployed objects |
| ## |
| commonLabels: { } |
| ## @param enableServiceLinks If set to false, disable Kubernetes service links in the pod spec |
| ## Ref: https://kubernetes.io/docs/tutorials/services/connect-applications-service/#accessing-the-service |
| ## |
| enableServiceLinks: true |
| ## @param commonAnnotations Annotations to add to all deployed objects |
| ## |
| commonAnnotations: { } |
| ## @param clusterDomain Default Kubernetes cluster domain |
| ## |
| clusterDomain: cluster.local |
| ## @param extraDeploy Array of extra objects to deploy with the release |
| ## |
| extraDeploy: [ ] |
| ## Enable diagnostic mode in the statefulset |
| ## |
| diagnosticMode: |
| ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) |
| ## |
| enabled: false |
| ## @param diagnosticMode.command Command to override all containers in the the statefulset |
| ## |
| command: |
| - sleep |
| ## @param diagnosticMode.args Args to override all containers in the the statefulset |
| ## |
| args: |
| - infinity |
| |
| ## @section Keycloak parameters |
| |
| ## Bitnami Keycloak image version |
| ## ref: https://hub.docker.com/r/bitnami/keycloak/tags/ |
| ## @param image.registry Keycloak image registry |
| ## @param image.repository Keycloak image repository |
| ## @param image.tag Keycloak image tag (immutable tags are recommended) |
| ## @param image.digest Keycloak image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag |
| ## @param image.pullPolicy Keycloak image pull policy |
| ## @param image.pullSecrets Specify docker-registry secret names as an array |
| ## @param image.debug Specify if debug logs should be enabled |
| ## |
| image: |
| registry: docker.io |
| repository: bitnami/keycloak |
| tag: 21.0.2-debian-11-r0 |
| digest: "" |
| ## Specify a imagePullPolicy |
| ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' |
| ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images |
| ## |
| pullPolicy: IfNotPresent |
| ## Optionally specify an array of imagePullSecrets. |
| ## Secrets must be manually created in the namespace. |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ |
| ## Example: |
| ## pullSecrets: |
| ## - myRegistryKeySecretName |
| ## |
| pullSecrets: [ ] |
| ## Set to true if you would like to see extra information on logs |
| ## |
| debug: false |
| ## Keycloak authentication parameters |
| ## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#admin-credentials |
| ## |
| auth: |
| ## @param auth.adminUser Keycloak administrator user |
| ## |
| adminUser: admin |
| ## @param auth.adminPassword Keycloak administrator password for the new user |
| ## |
| adminPassword: admin |
| ## @param auth.existingSecret Existing secret containing Keycloak admin password |
| ## |
| existingSecret: "" |
| ## @param auth.passwordSecretKey Key where the Keycloak admin password is being stored inside the existing secret. |
| ## |
| passwordSecretKey: "" |
| |
| ## HTTPS settings |
| ## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#tls-encryption |
| ## |
| tls: |
| ## @param tls.enabled Enable TLS encryption. Required for HTTPs traffic. |
| ## |
| enabled: false |
| ## @param tls.autoGenerated Generate automatically self-signed TLS certificates. Currently only supports PEM certificates |
| ## |
| autoGenerated: false |
| ## @param tls.existingSecret Existing secret containing the TLS certificates per Keycloak replica |
| ## Create this secret following the steps below: |
| ## 1) Generate your truststore and keystore files (more info at https://www.keycloak.org/docs/latest/server_installation/#_setting_up_ssl) |
| ## 2) Rename your truststore to `keycloak.truststore.jks` or use a different name overwriting the value 'tls.truststoreFilename'. |
| ## 3) Rename your keystores to `keycloak.keystore.jks` or use a different name overwriting the value 'tls.keystoreFilename'. |
| ## 4) Run the command below where SECRET_NAME is the name of the secret you want to create: |
| ## kubectl create secret generic SECRET_NAME --from-file=./keycloak.truststore.jks --from-file=./keycloak.keystore.jks |
| ## NOTE: If usePem enabled, make sure the PEM key and cert are named 'tls.key' and 'tls.crt' respectively. |
| ## |
| existingSecret: "" |
| ## @param tls.usePem Use PEM certificates as input instead of PKS12/JKS stores |
| ## If "true", the Keycloak chart will look for the files keycloak.key and keycloak.crt inside the secret provided with 'existingSecret'. |
| ## |
| usePem: false |
| ## @param tls.truststoreFilename Truststore filename inside the existing secret |
| ## |
| truststoreFilename: "keycloak.truststore.jks" |
| ## @param tls.keystoreFilename Keystore filename inside the existing secret |
| ## |
| keystoreFilename: "keycloak.keystore.jks" |
| ## @param tls.keystorePassword Password to access the keystore when it's password-protected |
| ## |
| keystorePassword: "" |
| ## @param tls.truststorePassword Password to access the truststore when it's password-protected |
| ## |
| truststorePassword: "" |
| ## @param tls.passwordsSecret Secret containing the Keystore and Truststore passwords. |
| ## |
| passwordsSecret: "" |
| |
| ## SPI TLS settings |
| ## ref: https://www.keycloak.org/server/keycloak-truststore |
| ## |
| spi: |
| ## @param spi.existingSecret Existing secret containing the Keycloak truststore for SPI connection over HTTPS/TLS |
| ## Create this secret following the steps below: |
| ## 1) Rename your truststore to `keycloak-spi.truststore.jks` or use a different name overwriting the value 'spi.truststoreFilename'. |
| ## 2) Run the command below where SECRET_NAME is the name of the secret you want to create: |
| ## kubectl create secret generic SECRET_NAME --from-file=./keycloak-spi.truststore.jks --from-file=./keycloak.keystore.jks |
| ## |
| existingSecret: "" |
| ## @param spi.truststorePassword Password to access the truststore when it's password-protected |
| ## |
| truststorePassword: "" |
| ## @param spi.truststoreFilename Truststore filename inside the existing secret |
| ## |
| truststoreFilename: "keycloak-spi.truststore.jks" |
| ## @param spi.passwordsSecret Secret containing the SPI Truststore passwords. |
| ## |
| passwordsSecret: "" |
| ## @param spi.hostnameVerificationPolicy Verify the hostname of the server’s certificate. Allowed values: "ANY", "WILDCARD", "STRICT". |
| ## |
| hostnameVerificationPolicy: "" |
| |
| ## @param production Run Keycloak in production mode. TLS configuration is required except when using proxy=edge. |
| ## |
| production: false |
| ## @param proxy reverse Proxy mode edge, reencrypt, passthrough or none |
| ## ref: https://www.keycloak.org/server/reverseproxy |
| ## |
| proxy: passthrough |
| ## @param httpRelativePath Set the path relative to '/' for serving resources. Useful if you are migrating from older version which were using '/auth/' |
| ## ref: https://www.keycloak.org/migration/migrating-to-quarkus#_default_context_path_changed |
| ## |
| httpRelativePath: "/" |
| ## Keycloak Service Discovery settings |
| ## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#cluster-configuration |
| ## |
| ## @param configuration Keycloak Configuration. Auto-generated based on other parameters when not specified |
| ## Specify content for keycloak.conf |
| ## NOTE: This will override configuring Keycloak based on environment variables (including those set by the chart) |
| ## The keycloak.conf is auto-generated based on other parameters when this parameter is not specified |
| ## |
| ## Example: |
| ## configuration: |- |
| ## foo: bar |
| ## baz: |
| ## |
| configuration: "" |
| ## @param existingConfigmap Name of existing ConfigMap with Keycloak configuration |
| ## NOTE: When it's set the configuration parameter is ignored |
| ## |
| existingConfigmap: "" |
| ## @param extraStartupArgs Extra default startup args |
| ## |
| extraStartupArgs: "" |
| ## @param initdbScripts Dictionary of initdb scripts |
| ## Specify dictionary of scripts to be run at first boot |
| ## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#initializing-a-new-instance |
| ## Example: |
| ## initdbScripts: |
| ## my_init_script.sh: | |
| ## #!/bin/bash |
| ## echo "Do something." |
| ## |
| initdbScripts: { } |
| ## @param initdbScriptsConfigMap ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`) |
| ## |
| initdbScriptsConfigMap: "" |
| ## @param command Override default container command (useful when using custom images) |
| ## |
| command: [ ] |
| ## @param args Override default container args (useful when using custom images) |
| ## |
| args: [ ] |
| ## @param extraEnvVars Extra environment variables to be set on Keycloak container |
| ## Example: |
| ## extraEnvVars: |
| ## - name: FOO |
| ## value: "bar" |
| ## |
| extraEnvVars: [ ] |
| ## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars |
| ## |
| extraEnvVarsCM: "" |
| ## @param extraEnvVarsSecret Name of existing Secret containing extra env vars |
| ## |
| extraEnvVarsSecret: "" |
| |
| ## @section Keycloak statefulset parameters |
| |
| ## @param replicaCount Number of Keycloak replicas to deploy |
| ## |
| replicaCount: 1 |
| ## @param containerPorts.http Keycloak HTTP container port |
| ## @param containerPorts.https Keycloak HTTPS container port |
| ## @param containerPorts.infinispan Keycloak infinispan container port |
| ## |
| containerPorts: |
| http: 8080 |
| https: 8443 |
| infinispan: 7800 |
| ## @param extraContainerPorts Optionally specify extra list of additional port-mappings for Keycloak container |
| ## |
| extraContainerPorts: [ ] |
| |
| ## Keycloak pods' SecurityContext |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod |
| ## @param podSecurityContext.enabled Enabled Keycloak pods' Security Context |
| ## @param podSecurityContext.fsGroup Set Keycloak pod's Security Context fsGroup |
| ## |
| podSecurityContext: |
| enabled: true |
| fsGroup: 1001 |
| ## Keycloak containers' Security Context |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container |
| ## @param containerSecurityContext.enabled Enabled Keycloak containers' Security Context |
| ## @param containerSecurityContext.runAsUser Set Keycloak container's Security Context runAsUser |
| ## @param containerSecurityContext.runAsNonRoot Set Keycloak container's Security Context runAsNonRoot |
| ## |
| containerSecurityContext: |
| enabled: true |
| runAsUser: 1001 |
| runAsNonRoot: true |
| ## Keycloak resource requests and limits |
| ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ |
| ## @param resources.limits The resources limits for the Keycloak containers |
| ## @param resources.requests The requested resources for the Keycloak containers |
| ## |
| resources: |
| limits: { } |
| requests: { } |
| ## Configure extra options for Keycloak containers' liveness, readiness and startup probes |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes |
| ## @param livenessProbe.enabled Enable livenessProbe on Keycloak containers |
| ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe |
| ## @param livenessProbe.periodSeconds Period seconds for livenessProbe |
| ## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe |
| ## @param livenessProbe.failureThreshold Failure threshold for livenessProbe |
| ## @param livenessProbe.successThreshold Success threshold for livenessProbe |
| ## |
| livenessProbe: |
| enabled: true |
| initialDelaySeconds: 300 |
| periodSeconds: 1 |
| timeoutSeconds: 5 |
| failureThreshold: 3 |
| successThreshold: 1 |
| ## @param readinessProbe.enabled Enable readinessProbe on Keycloak containers |
| ## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe |
| ## @param readinessProbe.periodSeconds Period seconds for readinessProbe |
| ## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe |
| ## @param readinessProbe.failureThreshold Failure threshold for readinessProbe |
| ## @param readinessProbe.successThreshold Success threshold for readinessProbe |
| ## |
| readinessProbe: |
| enabled: true |
| initialDelaySeconds: 30 |
| periodSeconds: 10 |
| timeoutSeconds: 1 |
| failureThreshold: 3 |
| successThreshold: 1 |
| ## When enabling this, make sure to set initialDelaySeconds to 0 for livenessProbe and readinessProbe |
| ## @param startupProbe.enabled Enable startupProbe on Keycloak containers |
| ## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe |
| ## @param startupProbe.periodSeconds Period seconds for startupProbe |
| ## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe |
| ## @param startupProbe.failureThreshold Failure threshold for startupProbe |
| ## @param startupProbe.successThreshold Success threshold for startupProbe |
| ## |
| startupProbe: |
| enabled: false |
| initialDelaySeconds: 30 |
| periodSeconds: 5 |
| timeoutSeconds: 1 |
| failureThreshold: 60 |
| successThreshold: 1 |
| ## @param customLivenessProbe Custom Liveness probes for Keycloak |
| ## |
| customLivenessProbe: { } |
| ## @param customReadinessProbe Custom Rediness probes Keycloak |
| ## |
| customReadinessProbe: { } |
| ## @param customStartupProbe Custom Startup probes for Keycloak |
| ## |
| customStartupProbe: { } |
| ## @param lifecycleHooks LifecycleHooks to set additional configuration at startup |
| ## |
| lifecycleHooks: { } |
| ## @param hostAliases Deployment pod host aliases |
| ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ |
| ## |
| hostAliases: [ ] |
| ## @param podLabels Extra labels for Keycloak pods |
| ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
| ## |
| podLabels: { } |
| ## @param podAnnotations Annotations for Keycloak pods |
| ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
| ## |
| podAnnotations: { } |
| ## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` |
| ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity |
| ## |
| podAffinityPreset: "" |
| ## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` |
| ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity |
| ## |
| podAntiAffinityPreset: soft |
| ## Node affinity preset |
| ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity |
| ## |
| nodeAffinityPreset: |
| ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` |
| ## |
| type: "" |
| ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. |
| ## E.g. |
| ## key: "kubernetes.io/e2e-az-name" |
| ## |
| key: "" |
| ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set. |
| ## E.g. |
| ## values: |
| ## - e2e-az1 |
| ## - e2e-az2 |
| ## |
| values: [ ] |
| ## @param affinity Affinity for pod assignment |
| ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
| ## |
| affinity: { } |
| ## @param nodeSelector Node labels for pod assignment |
| ## ref: https://kubernetes.io/docs/user-guide/node-selection/ |
| ## |
| nodeSelector: { } |
| ## @param tolerations Tolerations for pod assignment |
| ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
| ## |
| tolerations: [ ] |
| ## @param topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template |
| ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods |
| ## |
| topologySpreadConstraints: [ ] |
| ## @param podManagementPolicy Pod management policy for the Keycloak statefulset |
| ## |
| podManagementPolicy: Parallel |
| ## @param priorityClassName Keycloak pods' Priority Class Name |
| ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ |
| ## |
| priorityClassName: "" |
| ## @param schedulerName Use an alternate scheduler, e.g. "stork". |
| ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ |
| ## |
| schedulerName: "" |
| ## @param terminationGracePeriodSeconds Seconds Keycloak pod needs to terminate gracefully |
| ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods |
| ## |
| terminationGracePeriodSeconds: "" |
| ## @param updateStrategy.type Keycloak statefulset strategy type |
| ## @param updateStrategy.rollingUpdate Keycloak statefulset rolling update configuration parameters |
| ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies |
| ## |
| updateStrategy: |
| type: RollingUpdate |
| rollingUpdate: { } |
| ## @param extraVolumes Optionally specify extra list of additional volumes for Keycloak pods |
| ## |
| extraVolumes: [ ] |
| ## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for Keycloak container(s) |
| ## |
| extraVolumeMounts: [ ] |
| ## @param initContainers Add additional init containers to the Keycloak pods |
| ## Example: |
| ## initContainers: |
| ## - name: your-image-name |
| ## image: your-image |
| ## imagePullPolicy: Always |
| ## ports: |
| ## - name: portname |
| ## containerPort: 1234 |
| ## |
| initContainers: [ ] |
| ## @param sidecars Add additional sidecar containers to the Keycloak pods |
| ## Example: |
| ## sidecars: |
| ## - name: your-image-name |
| ## image: your-image |
| ## imagePullPolicy: Always |
| ## ports: |
| ## - name: portname |
| ## containerPort: 1234 |
| ## |
| sidecars: [ ] |
| |
| ## @section Exposure parameters |
| ## |
| |
| ## Service configuration |
| ## |
| service: |
| ## @param service.type Kubernetes service type |
| ## |
| type: LoadBalancer |
| ## @param service.http.enabled Enable http port on service |
| ## |
| http: |
| enabled: true |
| ## @param service.ports.http Keycloak service HTTP port |
| ## @param service.ports.https Keycloak service HTTPS port |
| ## |
| ports: |
| http: 80 |
| https: 443 |
| ## @param service.nodePorts [object] Specify the nodePort values for the LoadBalancer and NodePort service types. |
| ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport |
| ## |
| nodePorts: |
| http: "" |
| https: "" |
| ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin |
| ## Values: ClientIP or None |
| ## ref: https://kubernetes.io/docs/user-guide/services/ |
| ## |
| sessionAffinity: None |
| ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity |
| ## sessionAffinityConfig: |
| ## clientIP: |
| ## timeoutSeconds: 300 |
| ## |
| sessionAffinityConfig: { } |
| ## @param service.clusterIP Keycloak service clusterIP IP |
| ## e.g: |
| ## clusterIP: None |
| ## |
| clusterIP: "" |
| ## @param service.loadBalancerIP loadBalancerIP for the SuiteCRM Service (optional, cloud specific) |
| ## ref: https://kubernetes.io/docs/user-guide/services/#type-loadbalancer |
| ## |
| loadBalancerIP: "" |
| ## @param service.loadBalancerSourceRanges Address that are allowed when service is LoadBalancer |
| ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service |
| ## Example: |
| ## loadBalancerSourceRanges: |
| ## - 10.10.10.0/24 |
| ## |
| loadBalancerSourceRanges: [ ] |
| ## @param service.externalTrafficPolicy Enable client source IP preservation |
| ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
| ## |
| externalTrafficPolicy: Cluster |
| ## @param service.annotations Additional custom annotations for Keycloak service |
| ## |
| annotations: { } |
| ## @param service.extraPorts Extra port to expose on Keycloak service |
| ## |
| extraPorts: [ ] |
| # DEPRECATED service.extraHeadlessPorts will be removed in a future release, please use service.headless.extraPorts instead |
| ## @param service.extraHeadlessPorts Extra ports to expose on Keycloak headless service |
| ## |
| extraHeadlessPorts: [ ] |
| ## Headless service properties |
| ## |
| headless: |
| ## @param service.headless.annotations Annotations for the headless service. |
| ## |
| annotations: { } |
| ## @param service.headless.extraPorts Extra ports to expose on Keycloak headless service |
| ## |
| extraPorts: [ ] |
| ## Keycloak ingress parameters |
| ## ref: https://kubernetes.io/docs/user-guide/ingress/ |
| ## |
| ingress: |
| ## @param ingress.enabled Enable ingress record generation for Keycloak |
| ## |
| enabled: false |
| ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) |
| ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster . |
| ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ |
| ## |
| ingressClassName: "" |
| ## @param ingress.pathType Ingress path type |
| ## |
| pathType: ImplementationSpecific |
| ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) |
| ## |
| apiVersion: "" |
| ## @param ingress.hostname Default host for the ingress record (evaluated as template) |
| ## |
| hostname: keycloak.local |
| ## @param ingress.path Default path for the ingress record |
| ## |
| path: / |
| ## @param ingress.servicePort Backend service port to use |
| ## Default is http. Alternative is https. |
| ## |
| servicePort: http |
| ## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. |
| ## Use this parameter to set the required annotations for cert-manager, see |
| ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations |
| ## e.g: |
| ## annotations: |
| ## kubernetes.io/ingress.class: nginx |
| ## cert-manager.io/cluster-issuer: cluster-issuer-name |
| ## |
| annotations: { } |
| ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter |
| ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" (tpl .Values.ingress.hostname .) }}` |
| ## You can: |
| ## - Use the `ingress.secrets` parameter to create this TLS secret |
| ## - Rely on cert-manager to create it by setting the corresponding annotations |
| ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true` |
| ## |
| tls: false |
| ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm |
| ## |
| selfSigned: false |
| ## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record |
| ## e.g: |
| ## extraHosts: |
| ## - name: keycloak.local |
| ## path: / |
| ## |
| extraHosts: [ ] |
| ## @param ingress.extraPaths Any additional arbitrary paths that may need to be added to the ingress under the main host. |
| ## For example: The ALB ingress controller requires a special rule for handling SSL redirection. |
| ## extraPaths: |
| ## - path: /* |
| ## backend: |
| ## serviceName: ssl-redirect |
| ## servicePort: use-annotation |
| ## |
| extraPaths: [ ] |
| ## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record. |
| ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls |
| ## extraTls: |
| ## - hosts: |
| ## - keycloak.local |
| ## secretName: keycloak.local-tls |
| ## |
| extraTls: [ ] |
| ## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets |
| ## key and certificate should start with -----BEGIN CERTIFICATE----- or |
| ## -----BEGIN RSA PRIVATE KEY----- |
| ## |
| ## name should line up with a tlsSecret set further up |
| ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set |
| ## |
| ## It is also possible to create and manage the certificates outside of this helm chart |
| ## Please see README.md for more information |
| ## e.g: |
| ## - name: keycloak.local-tls |
| ## key: |
| ## certificate: |
| ## |
| secrets: [ ] |
| ## @param ingress.extraRules Additional rules to be covered with this ingress record |
| ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules |
| ## e.g: |
| ## extraRules: |
| ## - host: airflow.local |
| ## http: |
| ## path: / |
| ## backend: |
| ## service: |
| ## name: airflow-svc |
| ## port: |
| ## name: http |
| ## |
| extraRules: [ ] |
| |
| ## Network Policy configuration |
| ## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ |
| ## |
| networkPolicy: |
| ## @param networkPolicy.enabled Enable the default NetworkPolicy policy |
| ## |
| enabled: false |
| ## @param networkPolicy.allowExternal Don't require client label for connections |
| ## The Policy model to apply. When set to false, only pods with the correct |
| ## client label will have network access to the ports Keycloak is listening |
| ## on. When true, Keycloak will accept connections from any source |
| ## (with the correct destination port). |
| ## |
| allowExternal: true |
| ## @param networkPolicy.additionalRules Additional NetworkPolicy rules |
| ## Note that all rules are OR-ed. |
| ## Example: |
| ## additionalRules: |
| ## - matchLabels: |
| ## - role: frontend |
| ## - matchExpressions: |
| ## - key: role |
| ## operator: In |
| ## values: |
| ## - frontend |
| ## |
| additionalRules: { } |
| |
| ## @section RBAC parameter |
| ## Specifies whether a ServiceAccount should be created |
| ## |
| serviceAccount: |
| ## @param serviceAccount.create Enable the creation of a ServiceAccount for Keycloak pods |
| ## |
| create: true |
| ## @param serviceAccount.name Name of the created ServiceAccount |
| ## If not set and create is true, a name is generated using the fullname template |
| ## |
| name: "" |
| ## @param serviceAccount.automountServiceAccountToken Auto-mount the service account token in the pod |
| ## |
| automountServiceAccountToken: true |
| ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount |
| ## |
| annotations: { } |
| ## @param serviceAccount.extraLabels Additional labels for the ServiceAccount |
| ## |
| extraLabels: { } |
| ## Specifies whether RBAC resources should be created |
| ## |
| rbac: |
| ## @param rbac.create Whether to create and use RBAC resources or not |
| ## |
| create: false |
| ## @param rbac.rules Custom RBAC rules |
| ## Example: |
| ## rules: |
| ## - apiGroups: |
| ## - "" |
| ## resources: |
| ## - pods |
| ## verbs: |
| ## - get |
| ## - list |
| ## |
| rules: [ ] |
| |
| ## @section Other parameters |
| ## |
| |
| ## Keycloak Pod Disruption Budget configuration |
| ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ |
| ## |
| pdb: |
| ## @param pdb.create Enable/disable a Pod Disruption Budget creation |
| ## |
| create: false |
| ## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled |
| ## |
| minAvailable: 1 |
| ## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable |
| ## |
| maxUnavailable: "" |
| ## Keycloak Autoscaling configuration |
| ## @param autoscaling.enabled Enable autoscaling for Keycloak |
| ## @param autoscaling.minReplicas Minimum number of Keycloak replicas |
| ## @param autoscaling.maxReplicas Maximum number of Keycloak replicas |
| ## @param autoscaling.targetCPU Target CPU utilization percentage |
| ## @param autoscaling.targetMemory Target Memory utilization percentage |
| ## |
| autoscaling: |
| enabled: false |
| minReplicas: 1 |
| maxReplicas: 11 |
| targetCPU: "" |
| targetMemory: "" |
| |
| ## @section Metrics parameters |
| ## |
| |
| ## Metrics configuration |
| ## |
| metrics: |
| ## @param metrics.enabled Enable exposing Keycloak statistics |
| ## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#enabling-statistics |
| ## |
| enabled: false |
| ## Keycloak metrics service parameters |
| ## |
| service: |
| ## @param metrics.service.ports.http Metrics service HTTP port |
| ## |
| ports: |
| http: 8080 |
| ## @param metrics.service.annotations [object] Annotations for enabling prometheus to access the metrics endpoints |
| ## |
| annotations: |
| prometheus.io/scrape: "true" |
| prometheus.io/port: "{{ .Values.metrics.service.ports.http }}" |
| ## Prometheus Operator ServiceMonitor configuration |
| ## |
| serviceMonitor: |
| ## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using PrometheusOperator |
| ## |
| enabled: false |
| ## @param metrics.serviceMonitor.port Metrics service HTTP port |
| ## |
| port: http |
| ## @param metrics.serviceMonitor.endpoints [array] The endpoint configuration of the ServiceMonitor. Path is mandatory. Interval, timeout and labellings can be overwritten. |
| ## |
| endpoints: |
| - path: /metrics |
| - path: /realms/master/metrics |
| ## @param metrics.serviceMonitor.path Metrics service HTTP path. Deprecated: Use @param metrics.serviceMonitor.endpoints instead |
| ## |
| path: "" |
| ## @param metrics.serviceMonitor.namespace Namespace which Prometheus is running in |
| ## |
| namespace: "" |
| ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped |
| ## |
| interval: 30s |
| ## @param metrics.serviceMonitor.scrapeTimeout Specify the timeout after which the scrape is ended |
| ## e.g: |
| ## scrapeTimeout: 30s |
| ## |
| scrapeTimeout: "" |
| ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus |
| ## |
| labels: { } |
| ## @param metrics.serviceMonitor.selector Prometheus instance selector labels |
| ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration |
| ## |
| selector: { } |
| ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping |
| ## |
| relabelings: [ ] |
| ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion |
| ## |
| metricRelabelings: [ ] |
| ## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels |
| ## |
| honorLabels: false |
| ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. |
| ## |
| jobLabel: "" |
| ## Prometheus Operator alert rules configuration |
| ## |
| prometheusRule: |
| ## @param metrics.prometheusRule.enabled Create PrometheusRule Resource for scraping metrics using PrometheusOperator |
| ## |
| enabled: false |
| ## @param metrics.prometheusRule.namespace Namespace which Prometheus is running in |
| ## |
| namespace: "" |
| ## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus |
| ## |
| labels: { } |
| ## @param metrics.prometheusRule.groups Groups, containing the alert rules. |
| ## Example: |
| ## groups: |
| ## - name: Keycloak |
| ## rules: |
| ## - alert: KeycloakInstanceNotAvailable |
| ## annotations: |
| ## message: "Keycloak instance in namespace {{ `{{` }} $labels.namespace {{ `}}` }} has not been available for the last 5 minutes." |
| ## expr: | |
| ## absent(kube_pod_status_ready{namespace="{{ include "common.names.namespace" . }}", condition="true"} * on (pod) kube_pod_labels{pod=~"{{ include "common.names.fullname" . }}-\\d+", namespace="{{ include "common.names.namespace" . }}"}) != 0 |
| ## for: 5m |
| ## labels: |
| ## severity: critical |
| groups: [ ] |
| |
| ## @section keycloak-config-cli parameters |
| |
| ## Configuration for keycloak-config-cli |
| ## ref: https://github.com/adorsys/keycloak-config-cli |
| ## |
| keycloakConfigCli: |
| ## @param keycloakConfigCli.enabled Whether to enable keycloak-config-cli job |
| ## |
| enabled: true |
| ## Bitnami keycloak-config-cli image |
| ## ref: https://hub.docker.com/r/bitnami/keycloak-config-cli/tags/ |
| ## @param keycloakConfigCli.image.registry keycloak-config-cli container image registry |
| ## @param keycloakConfigCli.image.repository keycloak-config-cli container image repository |
| ## @param keycloakConfigCli.image.tag keycloak-config-cli container image tag |
| ## @param keycloakConfigCli.image.digest keycloak-config-cli container image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag |
| ## @param keycloakConfigCli.image.pullPolicy keycloak-config-cli container image pull policy |
| ## @param keycloakConfigCli.image.pullSecrets keycloak-config-cli container image pull secrets |
| ## |
| image: |
| registry: docker.io |
| repository: bitnami/keycloak-config-cli |
| tag: 5.6.1-debian-11-r5 |
| digest: "" |
| ## Specify a imagePullPolicy |
| ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' |
| ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images |
| ## |
| pullPolicy: IfNotPresent |
| ## Optionally specify an array of imagePullSecrets. |
| ## Secrets must be manually created in the namespace. |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ |
| ## e.g: |
| ## pullSecrets: |
| ## - myRegistryKeySecretName |
| ## |
| pullSecrets: [ ] |
| ## @param keycloakConfigCli.annotations [object] Annotations for keycloak-config-cli job |
| ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
| ## |
| annotations: |
| helm.sh/hook: "post-install,post-upgrade,post-rollback" |
| helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" |
| helm.sh/hook-weight: "5" |
| ## @param keycloakConfigCli.command Command for running the container (set to default if not set). Use array form |
| ## |
| command: |
| - java |
| - -jar |
| - /opt/bitnami/keycloak-config-cli/keycloak-config-cli.jar |
| ## @param keycloakConfigCli.args Args for running the container (set to default if not set). Use array form |
| ## |
| args: [ ] |
| ## @param keycloakConfigCli.hostAliases Job pod host aliases |
| ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ |
| ## |
| hostAliases: [ ] |
| ## Keycloak config CLI resource requests and limits |
| ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ |
| ## @param keycloakConfigCli.resources.limits The resources limits for the keycloak-config-cli container |
| ## @param keycloakConfigCli.resources.requests The requested resources for the keycloak-config-cli container |
| ## |
| resources: |
| limits: { } |
| requests: { } |
| ## keycloak-config-cli containers' Security Context |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container |
| ## @param keycloakConfigCli.containerSecurityContext.enabled Enabled keycloak-config-cli containers' Security Context |
| ## @param keycloakConfigCli.containerSecurityContext.runAsUser Set keycloak-config-cli container's Security Context runAsUser |
| ## @param keycloakConfigCli.containerSecurityContext.runAsNonRoot Set keycloak-config-cli container's Security Context runAsNonRoot |
| ## |
| containerSecurityContext: |
| enabled: true |
| runAsUser: 1001 |
| runAsNonRoot: true |
| ## keycloak-config-cli pods' Security Context |
| ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod |
| ## @param keycloakConfigCli.podSecurityContext.enabled Enabled keycloak-config-cli pods' Security Context |
| ## @param keycloakConfigCli.podSecurityContext.fsGroup Set keycloak-config-cli pod's Security Context fsGroup |
| ## |
| podSecurityContext: |
| enabled: true |
| fsGroup: 1001 |
| ## @param keycloakConfigCli.backoffLimit Number of retries before considering a Job as failed |
| ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy |
| ## |
| backoffLimit: 1 |
| ## @param keycloakConfigCli.podLabels Pod extra labels |
| ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ |
| ## |
| podLabels: { } |
| ## @param keycloakConfigCli.podAnnotations Annotations for job pod |
| ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ |
| ## |
| podAnnotations: { } |
| ## @param keycloakConfigCli.extraEnvVars Additional environment variables to set |
| ## Example: |
| ## extraEnvVars: |
| ## - name: FOO |
| ## value: "bar" |
| ## |
| ## @param keycloakConfigCli.nodeSelector Node labels for pod assignment |
| ## ref: https://kubernetes.io/docs/user-guide/node-selection/ |
| ## |
| nodeSelector: { } |
| ## |
| ## @param keycloakConfigCli.podTolerations Tolerations for job pod assignment |
| ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
| ## |
| podTolerations: [ ] |
| extraEnvVars: [ ] |
| ## @param keycloakConfigCli.extraEnvVarsCM ConfigMap with extra environment variables |
| ## |
| extraEnvVarsCM: "" |
| ## @param keycloakConfigCli.extraEnvVarsSecret Secret with extra environment variables |
| ## |
| extraEnvVarsSecret: "" |
| ## @param keycloakConfigCli.extraVolumes Extra volumes to add to the job |
| ## |
| extraVolumes: [ ] |
| ## @param keycloakConfigCli.extraVolumeMounts Extra volume mounts to add to the container |
| ## |
| extraVolumeMounts: [ ] |
| ## @param keycloakConfigCli.initContainers Add additional init containers to the Keycloak config cli pod |
| ## Example: |
| ## initContainers: |
| ## - name: your-image-name |
| ## image: your-image |
| ## imagePullPolicy: Always |
| ## ports: |
| ## - name: portname |
| ## containerPort: 1234 |
| ## |
| initContainers: [ ] |
| ## @param keycloakConfigCli.sidecars Add additional sidecar containers to the Keycloak config cli pod |
| ## Example: |
| ## sidecars: |
| ## - name: your-image-name |
| ## image: your-image |
| ## imagePullPolicy: Always |
| ## ports: |
| ## - name: portname |
| ## containerPort: 1234 |
| ## |
| sidecars: [ ] |
| ## @param keycloakConfigCli.configuration keycloak-config-cli realms configuration |
| ## NOTE: nil keys will be considered files to import locally |
| ## Example: |
| ## configuration: |
| ## realm1.json: | |
| ## { |
| ## "realm": "realm1", |
| ## "clients": [] |
| ## } |
| ## files/realm2.yaml: |
| ## realm3.yaml: | |
| ## realm: realm3 |
| ## clients: [] |
| ## |
| configuration: |
| realm-master.json: | |
| { |
| "realm": "master", |
| "displayName": "Aether Keycloak", |
| "displayNameHtml": "<img src='https://opennetworking.org/wp-content/uploads/2020/02/aether-logo.png'></img>", |
| "accessTokenLifespan": 86400, |
| "ssoSessionMaxLifespan": 86400, |
| "clients": [ |
| { |
| "clientId": "aether-roc-gui", |
| "name": "Aether ROC GUI", |
| "rootUrl": "http://aether-roc-gui:31194", |
| "adminUrl": "http://aether-roc-gui:31194", |
| "enabled": true, |
| "clientAuthenticatorType": "client-secret", |
| "redirectUris": [ |
| "http://aether-roc-gui:8183/*", |
| "http://localhost:8183/*", |
| "http://localhost:4200/*", |
| "http://aether-roc-gui:31194/*" |
| ], |
| "webOrigins": [ |
| "http://localhost:8183", |
| "http://localhost:4200", |
| "http://aether-roc-gui:8183", |
| "http://aether-roc-gui:31194" |
| ], |
| "protocol": "openid-connect", |
| "fullScopeAllowed": true, |
| "defaultClientScopes": [ |
| "profile", |
| "email" |
| ], |
| "optionalClientScopes": [ |
| "roles", |
| "groups", |
| "offline_access" |
| ] |
| } |
| ], |
| "clientScopes": [ |
| { |
| "name": "groups", |
| "description": "Groups scope", |
| "protocol": "openid-connect", |
| "attributes": { |
| "include.in.token.scope": "true", |
| "display.on.consent.screen": "true" |
| }, |
| "protocolMappers": [ |
| { |
| "name": "Groups Mapper", |
| "protocol": "openid-connect", |
| "protocolMapper": "oidc-group-membership-mapper", |
| "consentRequired": false, |
| "config": { |
| "full.path": "false", |
| "id.token.claim": "true", |
| "access.token.claim": "true", |
| "claim.name": "groups", |
| "userinfo.token.claim": "true" |
| } |
| } |
| ] |
| } |
| ], |
| "groups": [ |
| { |
| "name": "AetherROCAdmin", |
| "path": "/AetherROCAdmin" |
| }, |
| { |
| "name": "EnterpriseAdmin", |
| "path": "/EnterpriseAdmin" |
| }, |
| { |
| "name": "acme", |
| "path": "/acme" |
| }, |
| { |
| "name": "aiab-enterprise", |
| "path": "/aiab-enterprise" |
| }, |
| { |
| "name": "defaultent", |
| "path": "/defaultent" |
| }, |
| { |
| "name": "starbucks", |
| "path": "/starbucks" |
| }, |
| { |
| "name": "charactersGroup", |
| "path": "/charactersGroup" |
| }, |
| { |
| "name": "mixedGroup", |
| "path": "/mixedGroup" |
| } |
| ], |
| "users": [ |
| { |
| "username" : "alicea", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Alice", |
| "lastName" : "Admin", |
| "email" : "alicea@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/mixedGroup", "/AetherROCAdmin" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "bobc", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Bob", |
| "lastName" : "Cratchit", |
| "email" : "bobc@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/mixedGroup", "/charactersGroup" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "charlieb", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Charlie", |
| "lastName" : "Brown", |
| "email" : "charlieb@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/charactersGroup" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "daisyd", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Daisy", |
| "lastName" : "Duke", |
| "email" : "daisyd@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/charactersGroup", "/EnterpriseAdmin", "/starbucks", "/aiab-enterprise" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "elmerf", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Elmer", |
| "lastName" : "Fudd", |
| "email" : "elmerf@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/charactersGroup", "/starbucks", "/aiab-enterprise" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "fredf", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Fred", |
| "lastName" : "Flintstone", |
| "email" : "fredf@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/charactersGroup", "/EnterpriseAdmin", "/acme", "defaultent" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| }, |
| { |
| "username" : "gandalfg", |
| "enabled" : true, |
| "totp" : false, |
| "emailVerified" : false, |
| "firstName" : "Gandalf", |
| "lastName" : "The Grey", |
| "email" : "gandalfg@opennetworking.org", |
| "credentials": [ |
| { |
| "type": "password", |
| "value": "password" |
| } |
| ], |
| "realmRoles" : [ "default-roles-master" ], |
| "groups" : [ "/charactersGroup", "/acme", "defaultent" ], |
| "clientRoles": { |
| "account": [ |
| "view-profile", |
| "manage-account" |
| ] |
| }, |
| } |
| ] |
| } |
| ## @param keycloakConfigCli.existingConfigmap ConfigMap with keycloak-config-cli configuration. This will override `keycloakConfigCli.config` |
| ## NOTE: This will override keycloakConfigCli.configuration |
| ## |
| existingConfigmap: "" |
| ## Automatic Cleanup for Finished Jobs |
| ## @param keycloakConfigCli.cleanupAfterFinished.enabled Enables Cleanup for Finished Jobs |
| ## @param keycloakConfigCli.cleanupAfterFinished.seconds Sets the value of ttlSecondsAfterFinished |
| ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| ## |
| cleanupAfterFinished: |
| enabled: false |
| seconds: 600 |
| |
| ## @section Database parameters |
| |
| ## PostgreSQL chart configuration |
| ## ref: https://github.com/bitnami/charts/blob/main/bitnami/postgresql/values.yaml |
| ## @param postgresql.enabled Switch to enable or disable the PostgreSQL helm chart |
| ## @param postgresql.auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` with key `postgres-password` is provided |
| ## @param postgresql.auth.username Name for a custom user to create |
| ## @param postgresql.auth.password Password for the custom user to create |
| ## @param postgresql.auth.database Name for a custom database to create |
| ## @param postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials |
| ## @param postgresql.architecture PostgreSQL architecture (`standalone` or `replication`) |
| ## |
| postgresql: |
| enabled: true |
| auth: |
| postgresPassword: "" |
| username: bn_keycloak |
| password: "" |
| database: bitnami_keycloak |
| existingSecret: "" |
| architecture: standalone |
| ## External PostgreSQL configuration |
| ## All of these values are only used when postgresql.enabled is set to false |
| ## @param externalDatabase.host Database host |
| ## @param externalDatabase.port Database port number |
| ## @param externalDatabase.user Non-root username for Keycloak |
| ## @param externalDatabase.password Password for the non-root username for Keycloak |
| ## @param externalDatabase.database Keycloak database name |
| ## @param externalDatabase.existingSecret Name of an existing secret resource containing the database credentials |
| ## @param externalDatabase.existingSecretPasswordKey Name of an existing secret key containing the database credentials |
| ## |
| externalDatabase: |
| host: "" |
| port: 5432 |
| user: bn_keycloak |
| database: bitnami_keycloak |
| password: "" |
| existingSecret: "" |
| existingSecretPasswordKey: "" |
| |
| ## @section Keycloak Cache parameters |
| |
| ## Keycloak cache configuration |
| ## ref: https://www.keycloak.org/server/caching |
| ## @param cache.enabled Switch to enable or disable the keycloak distributed cache for kubernetes. |
| ## NOTE: Set to false to use 'local' cache (only supported when replicaCount=1). |
| ## @param cache.stackName Set infinispan cache stack to use |
| ## @param cache.stackFile Set infinispan cache stack filename to use |
| ## |
| cache: |
| enabled: true |
| stackName: kubernetes |
| stackFile: "" |
| |
| ## @section Keycloak Logging parameters |
| |
| ## Keycloak logging configuration |
| ## ref: https://www.keycloak.org/server/logging |
| ## @param logging.output Alternates between the default log output format or json format |
| ## @param logging.level Allowed values as documented: FATAL, ERROR, WARN, INFO, DEBUG, TRACE, ALL, OFF |
| ## |
| logging: |
| output: default |
| level: INFO |