wbsong111
fae1ec2668
breaking_change_check 결과 breaking=false — custom-values.yaml이 실제로 쓰는 키 (image, http.relativePath, command, ingress, proxy, resources, database, extraEnv) 중 어느 것도 diff에 걸리지 않았다. 유일한 템플릿 변경(probe 경로가 managementRelativePath를 coalesce로 우선하도록 바뀜)도 relativePath: "/" 를 그대로 쓰므로 동작 영향이 없다. CRD·의존성 변경 없음. appVersion은 26.6.4→26.7.2로 오르지만 custom-values.yaml이 자체 빌드 이미지 태그(26.7.1-bci15.7-hardened)를 명시적으로 고정하므로 이 업그레이드로 실제 배포 버전이 바뀌지는 않는다 — 26.7.2로 올리려면 hardened-containers에서 별도로 자체 빌드해야 한다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
254 lines
9.4 KiB
YAML
254 lines
9.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ include "keycloak.fullname" . }}
|
|
namespace: {{ include "keycloak.namespace" . }}
|
|
{{- with .Values.statefulsetAnnotations }}
|
|
annotations:
|
|
{{- range $key, $value := . }}
|
|
{{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "keycloak.labels" . | nindent 4 }}
|
|
{{- range $key, $value := .Values.statefulsetLabels }}
|
|
{{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
{{- include "keycloak.selectorLabels" . | nindent 6 }}
|
|
{{- if not .Values.autoscaling.enabled }}
|
|
replicas: {{ .Values.replicas }}
|
|
{{- end }}
|
|
serviceName: {{ include "keycloak.fullname" . }}-headless
|
|
podManagementPolicy: {{ .Values.podManagementPolicy }}
|
|
updateStrategy:
|
|
type: {{ .Values.updateStrategy }}
|
|
{{- if not (eq (.Values.revisionHistoryLimit | toString) "") }}
|
|
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config-startup: {{ include (print .Template.BasePath "/configmap-startup.yaml") . | sha256sum }}
|
|
checksum/secrets: {{ tpl (toYaml .Values.secrets) . | sha256sum }}
|
|
{{- range $key, $value := .Values.podAnnotations }}
|
|
{{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "keycloak.selectorLabels" . | nindent 8 }}
|
|
{{- range $key, $value := .Values.commonLabels }}
|
|
{{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }}
|
|
{{- end }}
|
|
{{- range $key, $value := .Values.podLabels }}
|
|
{{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- if not .Values.skipInitContainers }}
|
|
{{- if or .Values.dbchecker.enabled .Values.extraInitContainers }}
|
|
initContainers:
|
|
{{- if and .Values.dbchecker.enabled }}
|
|
- name: dbchecker
|
|
image: "{{ .Values.dbchecker.image.repository }}{{- if (.Values.dbchecker.image.digest) -}}@{{ .Values.dbchecker.image.digest }}{{- else -}}:{{ .Values.dbchecker.image.tag }} {{- end }}"
|
|
imagePullPolicy: {{ .Values.dbchecker.image.pullPolicy }}
|
|
securityContext:
|
|
{{- toYaml .Values.dbchecker.securityContext | nindent 12 }}
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
echo 'Waiting for Database to become ready...'
|
|
|
|
until printf "." && nc -z -w 2 {{ required ".Values.database.hostname is required if dbchecker is enabled!" .Values.database.hostname }} {{ required ".Values.database.port is required if dbchecker is enabled!" .Values.database.port }}; do
|
|
sleep 2;
|
|
done;
|
|
|
|
echo 'Database OK ✓'
|
|
resources:
|
|
{{- toYaml .Values.dbchecker.resources | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.extraInitContainers }}
|
|
{{- tpl . $ | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
containers:
|
|
- name: keycloak
|
|
securityContext:
|
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
|
image: "{{ .Values.image.repository }}{{- if (.Values.image.digest) -}}@{{ .Values.image.digest }}{{- else -}}:{{ .Values.image.tag | default .Chart.AppVersion }} {{- end }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
{{- if .Values.command }}
|
|
command:
|
|
{{- toYaml .Values.command | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.args }}
|
|
args:
|
|
{{- toYaml .Values.args | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.lifecycleHooks }}
|
|
lifecycle:
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
env:
|
|
{{- if and (.Values.http.relativePath) (eq .Values.http.relativePath "/") }}
|
|
- name: KC_HTTP_RELATIVE_PATH
|
|
value: {{ tpl .Values.http.relativePath $ }}
|
|
{{ else }}
|
|
- name: KC_HTTP_RELATIVE_PATH
|
|
value: {{ tpl .Values.http.relativePath $ | trimSuffix "/" }}
|
|
{{- end }}
|
|
{{- if .Values.http.managementRelativePath }}
|
|
- name: KC_HTTP_MANAGEMENT_RELATIVE_PATH
|
|
{{- if eq .Values.http.managementRelativePath "/" }}
|
|
value: {{ tpl .Values.http.managementRelativePath $ }}
|
|
{{- else }}
|
|
value: {{ tpl .Values.http.managementRelativePath $ | trimSuffix "/" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if eq .Values.cache.stack "default" }}
|
|
- name: KC_CACHE
|
|
value: "ispn"
|
|
- name: KC_CACHE_STACK
|
|
value: "jdbc-ping"
|
|
{{- end }}
|
|
{{- if .Values.proxy.enabled }}
|
|
- name: KC_PROXY_HEADERS
|
|
value: {{ .Values.proxy.mode }}
|
|
{{- end }}
|
|
{{- if .Values.proxy.http.enabled }}
|
|
- name: KC_HTTP_ENABLED
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if .Values.database.vendor }}
|
|
- name: KC_DB
|
|
value: {{ .Values.database.vendor }}
|
|
{{- end }}
|
|
{{- if .Values.database.hostname }}
|
|
- name: KC_DB_URL_HOST
|
|
value: {{ .Values.database.hostname }}
|
|
{{- end }}
|
|
{{- if .Values.database.port }}
|
|
- name: KC_DB_URL_PORT
|
|
value: {{ .Values.database.port | quote }}
|
|
{{- end }}
|
|
{{- if .Values.database.database }}
|
|
- name: KC_DB_URL_DATABASE
|
|
value: {{ .Values.database.database }}
|
|
{{- end }}
|
|
{{- if .Values.database.username }}
|
|
- name: KC_DB_USERNAME
|
|
value: {{ .Values.database.username }}
|
|
{{- end }}
|
|
{{- if or .Values.database.password .Values.database.existingSecret -}}
|
|
{{- include "keycloak.databasePasswordEnv" . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.metrics.enabled }}
|
|
- name: KC_METRICS_ENABLED
|
|
value: "true"
|
|
{{- end }}
|
|
{{- if .Values.health.enabled }}
|
|
- name: KC_HEALTH_ENABLED
|
|
value: "true"
|
|
{{- end }}
|
|
{{- with .Values.extraEnv }}
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
envFrom:
|
|
{{- with .Values.extraEnvFrom }}
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
- name: '{{ .Values.http.internalPort }}'
|
|
containerPort: 9000
|
|
protocol: TCP
|
|
{{- if .Values.service.httpsPort }}
|
|
- name: https
|
|
containerPort: 8443
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- with .Values.extraPorts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.health.enabled }}
|
|
{{- with .Values.livenessProbe }}
|
|
livenessProbe:
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.metrics.enabled }}
|
|
{{- with .Values.readinessProbe }}
|
|
readinessProbe:
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
{{- end}}
|
|
{{- with .Values.startupProbe }}
|
|
startupProbe:
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
volumeMounts:
|
|
{{- with .Values.extraVolumeMounts }}
|
|
{{- tpl . $ | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.extraContainers }}
|
|
{{- tpl . $ | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "keycloak.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
{{- with .Values.hostAliases }}
|
|
hostAliases:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
|
restartPolicy: {{ .Values.restartPolicy }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- tpl . $ | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.topologySpreadConstraints }}
|
|
topologySpreadConstraints:
|
|
{{- tpl . $ | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.priorityClassName }}
|
|
priorityClassName: {{ . }}
|
|
{{- end }}
|
|
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
|
volumes:
|
|
{{- with .Values.startupScripts }}
|
|
- name: startup
|
|
configMap:
|
|
name: {{ include "keycloak.fullname" $ }}-startup
|
|
defaultMode: 0555
|
|
items:
|
|
{{- range $key, $value := . }}
|
|
- key: {{ $key }}
|
|
path: {{ $key }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.extraVolumes }}
|
|
{{- tpl . $ | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.volumeClaimTemplates }}
|
|
volumeClaimTemplates:
|
|
{{- tpl . $ | nindent 4 }}
|
|
{{- end }}
|