apiVersion: k8s.keycloak.org/v2beta1
kind: Keycloak
metadata:
  name: keycloak
  labels:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/component: identity-provider
spec:
  instances: 1

  db:
    vendor: postgres
    host: platform-postgres-rw.platform-data.svc.cluster.local
    port: 5432
    database: keycloak
    schema: public
    usernameSecret:
      name: keycloak-db-credentials
      key: username
    passwordSecret:
      name: keycloak-db-credentials
      key: password
    poolInitialSize: 5
    poolMinSize: 5
    poolMaxSize: 20

  hostname:
    hostname: https://id.learn.hyeonworks.com
    strict: true

  http:
    httpEnabled: true
    httpPort: 8080
    serviceHttpPort: 8080

  proxy:
    headers: xforwarded

  ingress:
    enabled: false

  additionalOptions:
    - name: metrics-enabled
      value: "true"

  serviceMonitor:
    enabled: true
    interval: 30s
    scrapeTimeout: 10s
    labels:
      observability.hyeonworks.com/instance: home

  networkPolicy:
    enabled: true
    http:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: kube-system
        podSelector:
          matchLabels:
            app.kubernetes.io/name: traefik
    https:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: kube-system
        podSelector:
          matchLabels:
            app.kubernetes.io/name: traefik
    management:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: keycloak
        podSelector:
          matchLabels:
            app.kubernetes.io/name: keycloak-operator
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: observability
        podSelector:
          matchLabels:
            app.kubernetes.io/name: prometheus
            app.kubernetes.io/instance: observability-core-kube-pr-prometheus

  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: "2"
      memory: 2Gi

  transaction:
    xaEnabled: false