apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: mnt

resources:
  - ../../base
  - networkpolicy.yaml

labels:
  - pairs:
      app.kubernetes.io/instance: keycloak-operator
      app.kubernetes.io/component: identity-operator
      app.kubernetes.io/part-of: auth-platform
    includeSelectors: false
    includeTemplates: true

patches:
  - target:
      kind: ClusterRoleBinding
      name: keycloak-operator-clusterrole-binding
    patch: |-
      - op: replace
        path: /subjects/0/namespace
        value: mnt
  - target:
      kind: Deployment
      name: keycloak-operator
    patch: |-
      - op: add
        path: /spec/revisionHistoryLimit
        value: 5
      - op: add
        path: /spec/progressDeadlineSeconds
        value: 600
      - op: add
        path: /spec/template/spec/securityContext
        value:
          runAsNonRoot: true
          runAsUser: 1000
          runAsGroup: 1000
          fsGroup: 1000
          fsGroupChangePolicy: OnRootMismatch
          seccompProfile:
            type: RuntimeDefault
      - op: add
        path: /spec/template/spec/containers/0/securityContext
        value:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
      - op: add
        path: /spec/template/spec/containers/0/volumeMounts
        value:
          - name: tmp
            mountPath: /tmp
      - op: add
        path: /spec/template/spec/volumes
        value:
          - name: tmp
            emptyDir:
              sizeLimit: 128Mi
      - op: replace
        path: /spec/template/spec/containers/0/startupProbe/failureThreshold
        value: 18