63 lines
1.9 KiB
YAML
63 lines
1.9 KiB
YAML
apiVersion: k8s.keycloak.org/v2beta1
|
|
kind: KeycloakRealmImport
|
|
metadata:
|
|
name: platform-realm-v1
|
|
labels:
|
|
app.kubernetes.io/name: keycloak
|
|
app.kubernetes.io/instance: keycloak
|
|
app.kubernetes.io/version: "26.6.1"
|
|
app.kubernetes.io/component: identity-provider
|
|
app.kubernetes.io/part-of: auth-platform
|
|
app.kubernetes.io/managed-by: kustomize
|
|
spec:
|
|
keycloakCRName: keycloak
|
|
placeholders:
|
|
AUTH_SERVER_INGRESS_CLIENT_SECRET:
|
|
secret:
|
|
name: keycloak-client-auth-server-ingress
|
|
key: client-secret
|
|
realm:
|
|
realm: platform
|
|
enabled: true
|
|
sslRequired: external
|
|
registrationAllowed: true
|
|
loginWithEmailAllowed: true
|
|
accessTokenLifespan: 300
|
|
defaultRoles:
|
|
- user
|
|
roles:
|
|
realm:
|
|
- name: user
|
|
clients:
|
|
- clientId: auth-server-ingress
|
|
name: auth-server-ingress
|
|
protocol: openid-connect
|
|
publicClient: false
|
|
clientAuthenticatorType: client-secret
|
|
secret: ${AUTH_SERVER_INGRESS_CLIENT_SECRET}
|
|
standardFlowEnabled: true
|
|
directAccessGrantsEnabled: false
|
|
serviceAccountsEnabled: false
|
|
defaultClientScopes:
|
|
- profile
|
|
- email
|
|
- roles
|
|
protocolMappers:
|
|
- name: realm roles in id token
|
|
protocol: openid-connect
|
|
protocolMapper: oidc-usermodel-realm-role-mapper
|
|
config:
|
|
user.attribute: foo
|
|
claim.name: realm_access.roles
|
|
jsonType.label: String
|
|
multivalued: "true"
|
|
access.token.claim: "true"
|
|
id.token.claim: "true"
|
|
introspection.token.claim: "true"
|
|
redirectUris:
|
|
- http://auth.local.test/oauth2/callback
|
|
webOrigins:
|
|
- http://auth.local.test
|
|
rootUrl: http://auth.local.test
|
|
baseUrl: http://auth.local.test
|