apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
        vault.hashicorp.com/agent-inject-perms-keycloak-env: "0644"
        vault.hashicorp.com/agent-inject-secret-keycloak-env: kv/data/dev/systems/auth-system/postgres/keycloak
        vault.hashicorp.com/agent-inject-template-keycloak-env: |
          {{ with secret "kv/data/dev/systems/auth-system/postgres/keycloak" }}
          export KC_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
          {{ end }}

          {{ with secret "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" }}
          export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
          {{ end }}
        vault.hashicorp.com/role: keycloak-dev
    spec:
      automountServiceAccountToken: false
      volumes:
        - name: vault-token
          projected:
            defaultMode: 0444
            sources:
              - serviceAccountToken:
                  audience: vault
                  expirationSeconds: 3600
                  path: token
      containers:
        - name: keycloak
          command:
            - /bin/sh
            - -ec
          args:
            - |
              . /vault/secrets/keycloak-env
              exec /opt/keycloak/bin/kc.sh start-dev --import-realm --http-port=8080
          env:
            - $patch: replace
            - name: KC_DB
              value: postgres
            - name: KC_DB_URL
              value: jdbc:postgresql://postgres:5432/keycloak
            - name: KC_DB_USERNAME
              valueFrom:
                configMapKeyRef:
                  name: auth-system-config
                  key: KEYCLOAK_DB_USER
            - name: KC_HEALTH_ENABLED
              value: "true"
            - name: KC_BOOTSTRAP_ADMIN_USERNAME
              valueFrom:
                configMapKeyRef:
                  name: auth-system-config
                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME