68 lines
1.7 KiB
YAML
68 lines
1.7 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: mnt
|
|
|
|
resources:
|
|
- ../../base
|
|
- networkpolicy.yaml
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/instance: keycloak-operator
|
|
app.kubernetes.io/component: identity-operator
|
|
app.kubernetes.io/part-of: auth-platform
|
|
includeSelectors: false
|
|
includeTemplates: true
|
|
|
|
patches:
|
|
- target:
|
|
kind: ClusterRoleBinding
|
|
name: keycloak-operator-clusterrole-binding
|
|
patch: |-
|
|
- op: replace
|
|
path: /subjects/0/namespace
|
|
value: mnt
|
|
- target:
|
|
kind: Deployment
|
|
name: keycloak-operator
|
|
patch: |-
|
|
- op: add
|
|
path: /spec/revisionHistoryLimit
|
|
value: 5
|
|
- op: add
|
|
path: /spec/progressDeadlineSeconds
|
|
value: 600
|
|
- op: add
|
|
path: /spec/template/spec/securityContext
|
|
value:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- op: add
|
|
path: /spec/template/spec/containers/0/securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
- op: add
|
|
path: /spec/template/spec/containers/0/volumeMounts
|
|
value:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- op: add
|
|
path: /spec/template/spec/volumes
|
|
value:
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 128Mi
|
|
- op: replace
|
|
path: /spec/template/spec/containers/0/startupProbe/failureThreshold
|
|
value: 18
|