# _helpers.tpl
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "keycloak.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name.
We truncate to 20 characters because this is used to set the node identifier in WildFly which is limited to
23 characters. This allows for a replica suffix for up to 99 replicas.
*/}}
{{- define "keycloak.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 20 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 20 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 20 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}

{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "keycloak.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}

{{/*
Create a default fully qualified app name for the postgres requirement.
*/}}
{{- define "keycloak.postgresql.fullname" -}}
{{- $postgresContext := dict "Values" .Values.postgresql "Release" .Release "Chart" (dict "Name" "postgresql") -}}
{{ template "postgresql.fullname" $postgresContext }}
{{- end -}}

{{/*
Create the name for the database secret.
*/}}
{{- define "keycloak.externalDbSecret" -}}
{{- if .Values.keycloak.persistence.existingSecret -}}
  {{- .Values.keycloak.persistence.existingSecret -}}
{{- else -}}
  {{- template "keycloak.fullname" . -}}-db
{{- end -}}
{{- end -}}

{{/*
Create the name for the password secret key.
*/}}
{{- define "keycloak.dbPasswordKey" -}}
{{- if .Values.keycloak.persistence.existingSecret -}}
  {{- .Values.keycloak.persistence.existingSecretKey -}}
{{- else -}}
  password
{{- end -}}
{{- end -}}

{{/*
Create environment variables for database configuration.
*/}}
{{- define "keycloak.dbEnvVars" -}}
{{- if .Values.keycloak.persistence.deployPostgres }}
{{- if not (eq "postgres" .Values.keycloak.persistence.dbVendor) }}
{{ fail (printf "ERROR: 'Setting keycloak.persistence.deployPostgres' to 'true' requires setting 'keycloak.persistence.dbVendor' to 'postgres' (is: '%s')!" .Values.keycloak.persistence.dbVendor) }}
{{- end }}
- name: DB_VENDOR
  value: postgres
- name: DB_ADDR
  value: {{ template "keycloak.postgresql.fullname" . }}
- name: DB_PORT
  value: "5432"
- name: DB_DATABASE
  value: {{ .Values.postgresql.postgresDatabase | quote }}
- name: DB_USER
  value: {{ .Values.postgresql.postgresUser | quote }}
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ template "keycloak.postgresql.fullname" . }}
      key: postgres-password
{{- else }}
- name: DB_VENDOR
  value: {{ .Values.keycloak.persistence.dbVendor | quote }}
{{- if not (eq "h2" .Values.keycloak.persistence.dbVendor) }}
- name: DB_ADDR
  value: {{ .Values.keycloak.persistence.dbHost | quote }}
- name: DB_PORT
  value: {{ .Values.keycloak.persistence.dbPort | quote }}
- name: DB_DATABASE
  value: {{ .Values.keycloak.persistence.dbName | quote }}
- name: DB_USER
  value: {{ .Values.keycloak.persistence.dbUser | quote }}
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: {{ template "keycloak.externalDbSecret" . }}
      key: {{ include "keycloak.dbPasswordKey" . | quote }}
{{- end }}
{{- end }}
{{- end -}}
 # configmap.yaml
{{- $highAvailability := gt (int .Values.keycloak.replicas) 1 -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "keycloak.fullname" . }}
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
data:
  keycloak.sh: |
    #!/usr/bin/env bash

    set -eu

    /opt/jboss/keycloak/bin/jboss-cli.sh --file=/scripts/keycloak.cli

  {{- with .Values.keycloak.preStartScript }}
    echo 'Running custom pre-start script...'
{{ . | indent 4 }}
  {{- end }}

    exec /opt/jboss/tools/docker-entrypoint.sh -b 0.0.0.0 {{ .Values.keycloak.extraArgs }}{{- if $highAvailability }} -c standalone-ha.xml{{ else }} -c standalone.xml{{ end }}
    exit "$?"

  keycloak.cli: |
    embed-server {{- if $highAvailability }} --server-config=standalone-ha.xml{{ end }} --std-out=echo
    batch

{{- if ne .Values.keycloak.basepath "auth" }}
    # Changes the base path to be /keycloak.basepath instead of /auth
    /subsystem=keycloak-server:write-attribute(name=web-context,value={{ if eq .Values.keycloak.basepath "" }}ROOT{{ else }}{{ .Values.keycloak.basepath }}{{ end }})
    {{- if eq .Values.keycloak.basepath "" }}
    /subsystem=undertow/server=default-server/host=default-host:write-attribute(name=default-web-module,value=keycloak-server.war)
    {{- end }}
{{ end }}

{{- with .Values.keycloak.cli }}

{{ tpl .nodeIdentifier $ | indent 4 }}

{{ tpl .logging $ | indent 4 }}

{{ tpl .reverseProxy $ | indent 4 }}

{{ tpl .datasource $ | indent 4 }}

{{- if $highAvailability }}
{{ tpl .ha $ | indent 4 }}
{{- end }}

{{- with .custom }}
{{ tpl . $ | indent 4 }}
{{- end }}

{{- end }}

    run-batch
    stop-embedded-server
 # db-secret.yaml
{{- if and (not .Values.keycloak.persistence.deployPostgres) (not .Values.keycloak.persistence.existingSecret) -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "keycloak.fullname" . }}-db
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
type: Opaque
data:
  {{ template "keycloak.dbPasswordKey" . }}: {{ .Values.keycloak.persistence.dbPassword | b64enc | quote }}
{{- end -}}
 # headless-service.yaml
{{- $highAvailability := gt (int .Values.keycloak.replicas) 1 -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "keycloak.fullname" . }}-headless
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: http
      port: {{ .Values.keycloak.service.port }}
      targetPort: http
      protocol: TCP
  {{- if $highAvailability }}
    - name: jgroups
      port: {{ .Values.keycloak.service.jgroupsPort }}
      targetPort: jgroups
      protocol: TCP
  {{- end }}
  selector:
    app: {{ template "keycloak.name" . }}
    release: "{{ .Release.Name }}"
 # http-service.yaml
{{- $service := .Values.keycloak.service -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "keycloak.fullname" . }}-http
{{- with $service.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
{{- with $service.labels }}
{{ toYaml . | indent 4 }}
{{- end }}
spec:
  type: {{ $service.type }}
  ports:
    - name: http
      port: {{ $service.port }}
      targetPort: http
    {{- if and (eq "NodePort" $service.type) $service.nodePort }}
      nodePort: {{ $service.nodePort }}
    {{- end }}
      protocol: TCP
  selector:
    app: {{ template "keycloak.name" . }}
    release: "{{ .Release.Name }}"
 # ingress.yaml
{{- $ingress := .Values.keycloak.ingress -}}
{{- if $ingress.enabled -}}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ template "keycloak.fullname" . }}
{{- with $ingress.annotations }}
  annotations:
{{ toYaml . | indent 4 }}
{{- end }}
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
spec:
{{- if $ingress.tls }}
  tls:
  {{- range $ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range $ingress.hosts }}
    - host: {{ . }}
      http:
        paths:
          - path: {{ $ingress.path }}
            backend:
              serviceName: {{ template "keycloak.fullname" $ }}-http
              servicePort: http
  {{- end }}
{{- end -}}
 # keycloak-secret.yaml
{{- if not .Values.keycloak.existingSecret -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "keycloak.fullname" . }}-http
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
type: Opaque
data:
{{- if .Values.keycloak.password }}
        {{ .Values.keycloak.existingSecretKey }}: {{ .Values.keycloak.password | b64enc | quote }}
{{- else }}
        {{ .Values.keycloak.existingSecretKey }}: {{ randAlphaNum 10 | b64enc | quote }}
{{- end }}
{{- end}}
 # poddisruptionbudget.yaml
{{- if .Values.keycloak.podDisruptionBudget -}}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  name: {{ template "keycloak.fullname" . }}
spec:
  selector:
    matchLabels:
      app: {{ template "keycloak.name" . }}
      release: {{ .Release.Name }}
{{ toYaml .Values.keycloak.podDisruptionBudget | indent 2 }}
{{- end -}}
 # statefulset.yaml
{{- $highAvailability := gt (int .Values.keycloak.replicas) 1 -}}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ template "keycloak.fullname" . }}
  annotations:
    checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
spec:
  selector:
    matchLabels:
      app: {{ template "keycloak.name" . }}
      release: "{{ .Release.Name }}"
  replicas: {{ .Values.keycloak.replicas }}
  serviceName: {{ template "keycloak.fullname" . }}-headless
  podManagementPolicy: Parallel
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: {{ template "keycloak.name" . }}
        release: "{{ .Release.Name }}"
      {{- if .Values.keycloak.podLabels }}
{{ toYaml .Values.keycloak.podLabels | indent 8 }}
      {{- end }}        
{{- if .Values.keycloak.podAnnotations }}
      annotations:
{{ toYaml .Values.keycloak.podAnnotations | indent 8 }}
{{- end }}
    spec:
{{- with .Values.keycloak.hostAliases }}
      hostAliases:
{{ toYaml . | indent 8 }}
{{- end }}
      securityContext:
{{ toYaml .Values.keycloak.securityContext | indent 8 }}
    {{- with .Values.keycloak.image.pullSecrets }}
      imagePullSecrets:
      {{- range . }}
        - name: {{ . }}
      {{- end }}
    {{- end }}
    {{- if or .Values.keycloak.persistence.deployPostgres .Values.keycloak.extraInitContainers }}
      initContainers:
      {{- if .Values.keycloak.persistence.deployPostgres }}
        - name: wait-for-postgresql
          image: "{{ .Values.init.image.repository }}:{{ .Values.init.image.tag }}"
          imagePullPolicy: {{ .Values.init.image.pullPolicy }}
          command:
            - sh
            - -c
            - |
              until printf "." && nc -z -w 2 {{ template "keycloak.postgresql.fullname" . }} {{ .Values.postgresql.service.port }}; do
                  sleep 2;
              done;

              echo 'PostgreSQL OK ✓'
      {{- end }}
      {{- if .Values.keycloak.extraInitContainers }}
{{ tpl .Values.keycloak.extraInitContainers . | indent 8 }}
      {{- end }}
    {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.keycloak.image.repository }}:{{ .Values.keycloak.image.tag }}"
          imagePullPolicy: {{ .Values.keycloak.image.pullPolicy }}
          command:
            - /scripts/keycloak.sh
        {{- if .Values.keycloak.lifecycleHooks }}
          lifecycle:
{{ tpl .Values.keycloak.lifecycleHooks . | indent 12 }}
        {{- end }}
          env:
          {{- if .Release.IsInstall }}
            - name: KEYCLOAK_USER
              value: {{ .Values.keycloak.username }}
            - name: KEYCLOAK_PASSWORD
              valueFrom:
                secretKeyRef:
                  {{- if .Values.keycloak.existingSecret }}
                  name: {{ .Values.keycloak.existingSecret }}
                  {{- else }}
                  name: {{ template "keycloak.fullname" . }}-http
                  {{- end }}
                  key: {{ .Values.keycloak.existingSecretKey }}
          {{- end }}
          {{- if $highAvailability }}
            - name: JGROUPS_DISCOVERY_PROTOCOL
              value: "dns.DNS_PING"
            - name: JGROUPS_DISCOVERY_PROPERTIES
              value: "dns_query={{ template "keycloak.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
          {{- end }}
{{ include "keycloak.dbEnvVars" . | indent 12 }}
{{- with .Values.keycloak.extraEnv }}
{{ tpl . $ | indent 12 }}
{{- end }}
          volumeMounts:
            - name: scripts
              mountPath: /scripts
{{- with .Values.keycloak.extraVolumeMounts }}
{{ tpl . $ | indent 12 }}
{{- end }}
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          {{- if $highAvailability }}
            - name: jgroups
              containerPort: 7600
              protocol: TCP
          {{- end }}
{{- with .Values.keycloak.extraPorts }}
{{ tpl . $ | indent 12 }}
{{- end }}
          livenessProbe:
            httpGet:
              path: {{ if ne .Values.keycloak.basepath "" }}/{{ .Values.keycloak.basepath }}{{ end }}/
              port: http
            initialDelaySeconds: {{ .Values.keycloak.livenessProbe.initialDelaySeconds }}
            timeoutSeconds: {{ .Values.keycloak.livenessProbe.timeoutSeconds }}
          readinessProbe:
            httpGet:
              path: {{ if ne .Values.keycloak.basepath "" }}/{{ .Values.keycloak.basepath }}{{ end }}/realms/master
              port: http
            initialDelaySeconds: {{ .Values.keycloak.readinessProbe.initialDelaySeconds }}
            timeoutSeconds: {{ .Values.keycloak.readinessProbe.timeoutSeconds }}
          resources:
{{ toYaml .Values.keycloak.resources | indent 12 }}
{{- with .Values.keycloak.extraContainers }}
{{ tpl . $ | indent 8 }}
{{- end }}
    {{- with .Values.keycloak.affinity }}
      affinity:
{{ tpl . $ | indent 8 }}
    {{- end }}
    {{- with .Values.keycloak.nodeSelector }}
      nodeSelector:
{{ toYaml . | indent 8 }}
    {{- end }}
    {{- with .Values.keycloak.tolerations }}
      tolerations:
{{ toYaml . | indent 8 }}
    {{- end }}
{{- if .Values.keycloak.priorityClassName }}
      priorityClassName: {{ .Values.keycloak.priorityClassName }}
{{- end }}      
      terminationGracePeriodSeconds: 60
      volumes:
        - name: scripts
          configMap:
            name: {{ template "keycloak.fullname" . }}
            defaultMode: 0555
{{- with .Values.keycloak.extraVolumes }}
{{ tpl . $ | indent 8 }}
{{- end }}
 # test-configmap.yaml
{{- if .Values.test.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "keycloak.fullname" . }}-test
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
data:
  test.py: |
    import os
    from selenium import webdriver
    from selenium.webdriver.common.by import By
    from selenium.webdriver.support.ui import WebDriverWait
    from selenium.webdriver.support import expected_conditions
    from urllib.parse import urlparse

    print('Creating PhantomJS driver...')
    driver = webdriver.PhantomJS(service_log_path='/tmp/ghostdriver.log')

    base_url = 'http://{{ template "keycloak.fullname" . }}-http{{ if ne 80 (int .Values.keycloak.service.port) }}{{ .Values.keycloak.service.port }}{{ end }}'

    print('Opening Keycloak...')
    driver.get('{0}/auth/admin/'.format(base_url))

    username = os.environ['KEYCLOAK_USER']
    password = os.environ['KEYCLOAK_PASSWORD']

    username_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "username")))
    password_input = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "password")))
    login_button = WebDriverWait(driver, 30).until(expected_conditions.presence_of_element_located((By.ID, "kc-login")))

    print('Entering username...')
    username_input.send_keys(username)

    print('Entering password...')
    password_input.send_keys(password)

    print('Clicking login button...')
    login_button.click()

    current_url = urlparse(driver.current_url)
    expected_url = urlparse('{0}/auth/admin/master/console/'.format(base_url))

    print('Current URL: {0}'.format(current_url))
    print('Expected URL: {0}'.format(expected_url))

    if current_url.path != expected_url.path:
        print('Login failed. Current url is not expected url')
        exit(1)

    print('URLs match. Login successful.')

    driver.quit()
{{- end }}
 # test-pod.yaml
{{- if .Values.test.enabled }}
apiVersion: v1
kind: Pod
metadata:
  name: "{{ template "keycloak.fullname" . }}-test-{{ randAlphaNum 5 | lower }}"
  labels:
    app: {{ template "keycloak.name" . }}
    chart: {{ template "keycloak.chart" . }}
    release: "{{ .Release.Name }}"
    heritage: "{{ .Release.Service }}"
    role: test
  annotations:
    "helm.sh/hook": test-success
spec:
  securityContext:
{{ toYaml .Values.test.securityContext | indent 8 }}
  containers:
    - name: {{ .Chart.Name }}-test
      image: "{{ .Values.test.image.repository }}:{{ .Values.test.image.tag }}"
      imagePullPolicy: {{ .Values.test.image.pullPolicy }}
      command:
        - python3
        - /tests/test.py
      env:
        - name: KEYCLOAK_USER
          value: {{ .Values.keycloak.username }}
        - name: KEYCLOAK_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{ template "keycloak.fullname" . }}-http
              key: password
      volumeMounts:
        - name: tests
          mountPath: /tests
  volumes:
    - name: tests
      configMap:
        name: {{ template "keycloak.fullname" . }}-test
  restartPolicy: Never
{{- end }}

init:
  image:
    repository: alpine
    tag: 3.8
    pullPolicy: IfNotPresent

clusterDomain: cluster.local

keycloak:
  replicas: 1

  image:
    repository: jboss/keycloak
    tag: 5.0.0
    pullPolicy: IfNotPresent

    ## Optionally specify an array of imagePullSecrets.
    ## Secrets must be manually created in the namespace.
    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
    ##
    pullSecrets: []
    # - myRegistrKeySecretName

  hostAliases: []
  #  - ip: "1.2.3.4"
  #    hostnames:
  #      - "my.host.com"

  securityContext:
    runAsUser: 1000
    fsGroup: 1000
    runAsNonRoot: true

  ## The path keycloak will be served from. To serve keycloak from the root path, use two quotes (e.g. "").
  basepath: auth

  ## Additional init containers, e. g. for providing custom themes
  extraInitContainers: |

  ## Additional sidecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy
  extraContainers: |

  ## Custom script that is run before Keycloak is started.
  preStartScript:

  ## lifecycleHooks defines the container lifecycle hooks
  lifecycleHooks: |
    # postStart:
    #   exec:
    #     command: ["/bin/sh", "-c", "ls"]

  ## Additional arguments to start command e.g. -Dkeycloak.import= to load a realm
  extraArgs: ""

  ## Username for the initial Keycloak admin user
  username: keycloak

  ## Password for the initial Keycloak admin user. Applicable only if existingSecret is not set.
  ## If not set, a random 10 characters password will be used
  password: ""

  # Specifies an existing secret to be used for the admin password
  existingSecret: ""

  # The key in the existing secret that stores the password
  existingSecretKey: password

  ## Allows the specification of additional environment variables for Keycloak
  extraEnv: |
    # - name: KEYCLOAK_LOGLEVEL
    #   value: DEBUG
    # - name: WILDFLY_LOGLEVEL
    #   value: DEBUG
    # - name: CACHE_OWNERS
    #   value: "2"
    # - name: DB_QUERY_TIMEOUT
    #   value: "60"
    # - name: DB_VALIDATE_ON_MATCH
    #   value: true
    # - name: DB_USE_CAST_FAIL
    #   value: false

  affinity: |
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
              app:  {{ template "keycloak.name" . }}
              release: "{{ .Release.Name }}"
            matchExpressions:
              - key: role
                operator: NotIn
                values:
                  - test
          topologyKey: kubernetes.io/hostname
      preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 100
          podAffinityTerm:
            labelSelector:
              matchLabels:
                app:  {{ template "keycloak.name" . }}
                release: "{{ .Release.Name }}"
              matchExpressions:
                - key: role
                  operator: NotIn
                  values:
                    - test
            topologyKey: failure-domain.beta.kubernetes.io/zone

  nodeSelector: {}
  priorityClassName: ""
  tolerations: []

  ## Additional pod labels
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  podLabels: {}

  ## Extra Annotations to be added to pod
  podAnnotations: {}

  livenessProbe:
    initialDelaySeconds: 120
    timeoutSeconds: 5
  readinessProbe:
    initialDelaySeconds: 30
    timeoutSeconds: 1

  resources: {}
    # limits:
    #   cpu: "100m"
    #   memory: "1024Mi"
    # requests:
    #   cpu: "100m"
    #   memory: "1024Mi"

  ## WildFly CLI configurations. They all end up in the file 'keycloak.cli' configured in the configmap which is
  ## executed on server startup.
  cli:
    nodeIdentifier: |
      {{ .Files.Get "scripts/node-identifier.cli" }}

    logging: |
      {{ .Files.Get "scripts/logging.cli" }}

    reverseProxy: |
      {{ .Files.Get "scripts/reverse-proxy.cli" }}

    ha: |
      {{ .Files.Get "scripts/ha.cli" }}

    datasource: |
      {{ .Files.Get "scripts/datasource.cli" }}

    # Custom CLI script
    custom: |

  ## Add additional volumes and mounts, e. g. for custom themes
  extraVolumes: |
  extraVolumeMounts: |

  ## Add additional ports, eg. for custom admin console
  extraPorts: |

  podDisruptionBudget: {}
    # maxUnavailable: 1
    # minAvailable: 1

  service:
    annotations: {}
    # service.beta.kubernetes.io/aws-load-balancer-internal: "0.0.0.0/0"

    labels: {}
    # key: value

    ## ServiceType
    ## ref: https://kubernetes.io/docs/user-guide/services/#publishing-services---service-types
    type: ClusterIP

    ## Optional static port assignment for service type NodePort.
    # nodePort: 30000

    port: 80

    # Optional: jGroups port for high availability clustering
    jgroupsPort: 7600

  ## Ingress configuration.
  ## ref: https://kubernetes.io/docs/user-guide/ingress/
  ingress:
    enabled: false
    path: /

    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
      # ingress.kubernetes.io/affinity: cookie

    ## List of hosts for the ingress
    hosts:
      - keycloak.example.com

    ## TLS configuration
    tls: []
    # - hosts:
    #     - keycloak.example.com
    #   secretName: tls-keycloak

  ## Persistence configuration
  persistence:
    # If true, the Postgres chart is deployed
    deployPostgres: false

    # The database vendor. Can be either "postgres", "mysql", "mariadb", or "h2"
    dbVendor: h2

    ## The following values only apply if "deployPostgres" is set to "false"

    # Specifies an existing secret to be used for the database password
    existingSecret: ""

    # The key in the existing secret that stores the password
    existingSecretKey: password

    dbName: keycloak
    dbHost: mykeycloak
    dbPort: 5432
    dbUser: keycloak

    # Only used if no existing secret is specified. In this case a new secret is created
    dbPassword: ""

postgresql:
  ### PostgreSQL User to create.
  ##
  postgresUser: keycloak

  ## PostgreSQL Password for the new user.
  ## If not set, a random 10 characters password will be used.
  ##
  postgresPassword: ""

  ## PostgreSQL Database to create.
  ##
  postgresDatabase: keycloak

  ## Persistent Volume Storage configuration.
  ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes
  ##
  persistence:
    ## Enable PostgreSQL persistence using Persistent Volume Claims.
    ##
    enabled: false

test:
  enabled: true
  image:
    repository: unguiculus/docker-python3-phantomjs-selenium
    tag: v1
    pullPolicy: IfNotPresent
  securityContext:
    runAsUser: 1000
    fsGroup: 1000
    runAsNonRoot: true
