apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: mnt

resources:
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/kubernetes.yml
  - networkpolicy.yaml

patches:
  - target:
      kind: ClusterRoleBinding
      name: keycloak-operator-clusterrole-binding
    patch: |-
      - op: replace
        path: /subjects/0/namespace
        value: mnt
  - target:
      kind: Deployment
      name: keycloak-operator
    patch: |-
      - op: add
        path: /spec/template/spec/securityContext
        value:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
      - op: add
        path: /spec/template/spec/containers/0/securityContext
        value:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
      - op: replace
        path: /spec/template/spec/containers/0/startupProbe/failureThreshold
        value: 18