apiVersion: k8s.keycloak.org/v2beta1
kind: KeycloakRealmImport
metadata:
  name: platform-realm-v1
  labels:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/version: "26.6.1"
    app.kubernetes.io/component: identity-provider
    app.kubernetes.io/part-of: auth-platform
    app.kubernetes.io/managed-by: kustomize
spec:
  keycloakCRName: keycloak
  placeholders:
    AUTH_SERVER_INGRESS_CLIENT_SECRET:
      secret:
        name: keycloak-client-auth-server-ingress
        key: client-secret
  realm:
    realm: platform
    enabled: true
    sslRequired: external
    registrationAllowed: true
    loginWithEmailAllowed: true
    accessTokenLifespan: 300
    defaultRoles:
      - user
    roles:
      realm:
        - name: user
    clients:
      - clientId: auth-server-ingress
        name: auth-server-ingress
        protocol: openid-connect
        publicClient: false
        clientAuthenticatorType: client-secret
        secret: ${AUTH_SERVER_INGRESS_CLIENT_SECRET}
        standardFlowEnabled: true
        directAccessGrantsEnabled: false
        serviceAccountsEnabled: false
        defaultClientScopes:
          - profile
          - email
          - roles
        protocolMappers:
          - name: realm roles in id token
            protocol: openid-connect
            protocolMapper: oidc-usermodel-realm-role-mapper
            config:
              user.attribute: foo
              claim.name: realm_access.roles
              jsonType.label: String
              multivalued: "true"
              access.token.claim: "true"
              id.token.claim: "true"
              introspection.token.claim: "true"
        redirectUris:
          - http://auth.local.test/oauth2/callback
        webOrigins:
          - http://auth.local.test
        rootUrl: http://auth.local.test
        baseUrl: http://auth.local.test