feat(deployment): adding k8s deployment docs for postgres and keycloak

xmlking · Mar 6, 2019 · 49c4c75 · 49c4c75
1 parent 92a9491
commit 49c4c75
Show file tree

Hide file tree

Showing 23 changed files with 2,585 additions and 0 deletions.
diff --git a/.deploy/keycloak/01-keycloak-configmap.yaml b/.deploy/keycloak/01-keycloak-configmap.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+data:
+  DB_VENDOR: POSTGRES
+  DB_ADDR: postgres
+  DB_PORT: '5432'
+# https://issues.jboss.org/browse/KEYCLOAK-7739
+  POSTGRES_PORT: '5432'
+  DB_DATABASE: keycloak
+  DB_USER: keycloak
+  KEYCLOAK_USER: admin
+  ROOT_LOGLEVEL: WARN
+  KEYCLOAK_LOGLEVEL: INFO
+  PROXY_ADDRESS_FORWARDING: 'true'
diff --git a/.deploy/keycloak/02-keycloak-secrets-tls.yml b/.deploy/keycloak/02-keycloak-secrets-tls.yml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloak-secrets-tls
+  labels:
+    app: keycloak
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURDRENDQWZDZ0F3SUJBZ0lKQUpxYUFOcTRmTGpqTUEwR0NTcUdTSWIzRFFFQkN3VUFNQmt4RnpBVkJnTlYKQkFNTURqRTVNaTR4TmpndU9Ua3VNVEF3TUI0WERURTVNREV6TURJeU5UZ3dOVm9YRFRJd01ERXpNREl5TlRndwpOVm93R1RFWE1CVUdBMVVFQXd3T01Ua3lMakUyT0M0NU9TNHhNREF3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBCkE0SUJEd0F3Z2dFS0FvSUJBUUM2eXc0S0IzR0FFTU85aS9IZFdjUjBpSUlQOE80eUw4eDk3dlBnTUY4emdyTkgKU2Q3eUUvUUo4b1VHUFV4UGR2SllJY0t5bGp0azJuMjZEWDBYTmJzdkRoL2xBbDZBaEwzQ0tYNVowcmFoczhrOQpvc1Z4dGZPOHRBcE0xR3hFNm4wRWk2eU8zRFdrMEhNSW10ZUNranpLWHIwaHhxeUtXckRkSW1MdUIyVEszdmhhClNVVmRhM0t5bFp1ZGZCb1pFalRJdGxORE4zcFdkRjFpZEgxWXhpYmlFMytoU2U3YlNJRi8ydTEySEQ0TjFvUlAKbDdxTmNRUGw4ODN2aFpPRW0wL3g3cklkdTJRMFd2V0FtODZaQVgzMndTcDBTdHRsdjBRT0FSVTJRb2pTMVBLcgpFZlZsWjY4cFR2S1JJc0JDRTViOUdySkR6YnhDa2dqS1pjSFUvRmZaQWdNQkFBR2pVekJSTUIwR0ExVWREZ1FXCkJCU3N3ZDMzMzN4d3djME9xdkFOUmt4RG9jY1VNakFmQmdOVkhTTUVHREFXZ0JTc3dkMzMzM3h3d2MwT3F2QU4KUmt4RG9jY1VNakFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFqU2ZCUgppaGJaM05nTzY5ZDd1b29sSTgrYWo0K29IaldkRjFVRktMNWFaVDRzN2tUVDM3T1p0LzY2YXdwQ2JQOXdwbjdMCjEwMDVZdFRlOU1DclVoVWU4K1luUmplbjAyUit0TjA1SXp5VGZRQWlUa1g0OCs3WVVySGtxZGppN3ZVN21yVXUKNzlxdXNqYWJNQWhDL0RtcnNWWk1wZmxJWm42M2NpZi9KelFlaWpyc2x4dHNPdjRNZDF3RVBHR2lrMjRyY3czagpYSy9YWmQvSGpUT1QvRkwyWkQ2SDAwcHNtb2tnMXp1d3QwS0dweDhrMXFKR04wbzYxdjM5QTVaU2tJcTVSWDlMCk1Ma2NCQjlwRWw3MC83cmZNaFNST3FvZWw4ZVloZW1jTGpYTnhEb3ZhM20yeUFrNVY2eU0ybGMyeExHMlBKdk4KZkJqemsvNDdXdmFraVdZWQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzZ5dzRLQjNHQUVNTzkKaS9IZFdjUjBpSUlQOE80eUw4eDk3dlBnTUY4emdyTkhTZDd5RS9RSjhvVUdQVXhQZHZKWUljS3lsanRrMm4yNgpEWDBYTmJzdkRoL2xBbDZBaEwzQ0tYNVowcmFoczhrOW9zVnh0Zk84dEFwTTFHeEU2bjBFaTZ5TzNEV2swSE1JCm10ZUNranpLWHIwaHhxeUtXckRkSW1MdUIyVEszdmhhU1VWZGEzS3lsWnVkZkJvWkVqVEl0bE5ETjNwV2RGMWkKZEgxWXhpYmlFMytoU2U3YlNJRi8ydTEySEQ0TjFvUlBsN3FOY1FQbDg4M3ZoWk9FbTAveDdySWR1MlEwV3ZXQQptODZaQVgzMndTcDBTdHRsdjBRT0FSVTJRb2pTMVBLckVmVmxaNjhwVHZLUklzQkNFNWI5R3JKRHpieENrZ2pLClpjSFUvRmZaQWdNQkFBRUNnZ0VBUHAvZE1SZVZ3ZTNjOGl0OUIwMFZSRXlQN25CRUs2ZEMwK1hNOVpqQ0VpNzcKbENiOERBVU1pRms2cUFEZEdMYzBRTC93MnBicmlzQ0Y3bDZmVmF5NStPaXZZTVFPa3QvdURxNkNvZkszTURkcQpmTE9acHFudDhaSWE4ZTgxN1ZVQVhRbkc3STUvbmFZVkt3bGV2M1B2MVprMXA2RklMNHFBU1dOQjc3T2k0ekNTCjBybm82bWJqWlZoLzBDcXdvVE5sMmZSSkJHRCswMjAwWDNYc1N5UlB0WXl1dy94bmhBcWovNTh0V2FsRzVCZ3AKZURDMzdma3RORFF6QnhxYmtOa3NJRm5Mc2lhY3FzaVFveXM5dEh5Z2RZazNBbm1hV0NKMHV0MlpWK1FSZzBITQpYeE44eHRYL1BLSGpsMmoyanA4ZGd5VzQ3S2hTTUdVSnpSSkJUSU4xRVFLQmdRRHMwWk5Qbzd6cUFXYkRCdFhXCkxlS1EyZUIzLzhqQk5VNGloU1R3Q01TdHpjdnVSdzFJRHBUTlQrNWdmN3dhdEo4clVYYks5U0FmZHBBcHNNN0YKK0I1QkU2eTBtZXZPT1pPVUJLalpkVlhDRENiZENJL2FQdmNhTE1CVFFYR2xPWGt3YXg3RHZPaU1iWUJqZStwbgpwU253d09uUmw5VG95WjZ3WEQvaUhHNjVwd0tCZ1FESjdEUVRtR2lEUEpRK21UcnMzTDBBOExpbHRQQXpVb0RnCjZOZU1MbjFvanpmbnFCK0hoY3ArUFRkTEdaL3UvdEJoSlBpMjhGYnA5d29UZjZsOVRUeTdiWXVJTmhnR0FFOTUKTllmWmdZRnoxeG81NWFRMGlVdUlTU2VLd2tlckUwalhjZDJHUS9BVTNJS2pHNWsyN0NyODJOYW1ZMWprVmNYaApWSnVkMWd1U2Z3S0JnUURmc3EvbUlKTUlzRDR6cHpkQzA2RWFsdFIwUmNlS3lpRitkaXFJR3FBK1ZSRjNpT0pBCjJKVXl3M2cyNnpIeVAvL0NXWGRQQy9GR0J5YnlXck5YU2FLNmNpMUhnOFc4emFKYnhYTUJ4dFkxTUdsZGpRTGwKYzJqUzdzYlZYaEpOc2xhSnFBWXRlenBudTkvMUdVNDRqVWxxdzYrYWJrT05pVFkrL1VUUy8yeVFMUUtCZ1FDUwptODJ6N0pUMXRLWnVUUk5icDJvVHBMUnNuRk5LOER4akVLeHdPOUVTZWVvOWFQUjdrY2pVbjkzbHlWVTJVZzA2CmUzMmFWaWJFK1hsM2J0bkJBTE4zNHJITTFIbmM0WnpTaE90K0lXbThraEdZdUFQaG9VNFdSZ2RQMkgvdzFxK3MKdmgvNXZKbzBpMmJPeHRzWDVhSFF0Q0FsN3p3N2pZdC9iODhOYXJ3OFFRS0JnRnprS2hUT3FETlVCL1ErSWJqMwpoeDNEbVA3bzNxNURkWWlITTU5bTVsN0NNK3dmWTF6Wmtlb3RQZGpsZEZZbDdEdWx3TjFjUlRSbnk2YkxrcXl3CmlwYlNHQ3ZTQ0NTUmFxeU9WckR6UENFUkdvbXVqNjhlcXl0a2Eyck9lWnB5SStFUWtTZnNlMVpmUXRjTjA4Q0IKZy9VMGZpNm1pdzBvQmVCZ3FLMElwS3V0Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/.deploy/keycloak/02-keycloak-secrets.yaml b/.deploy/keycloak/02-keycloak-secrets.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+type: Opaque
+data:
+  KEYCLOAK_PASSWORD: YWRtaW4xMjM=
+  DB_PASSWORD: a2V5Y2xvYWsxMjM=
+stringData:
+  KEYCLOAK_PASSWORD: admin123
+  DB_PASSWORD: keycloak123
diff --git a/.deploy/keycloak/03-keycloak-storage.yaml b/.deploy/keycloak/03-keycloak-storage.yaml
@@ -0,0 +1,15 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+# use hostpath when deploying local k8s and use nas-thin for k8s cluster
+  storageClassName: hostpath
+  #  storageClassName: nas-thin
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/.deploy/keycloak/04-keycloak-deployment.yaml b/.deploy/keycloak/04-keycloak-deployment.yaml
@@ -0,0 +1,82 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      securityContext:
+        runAsUser: 1000
+        fsGroup: 1000
+        runAsNonRoot: true
+      terminationGracePeriodSeconds: 60
+      initContainers:
+        - name: wait-for-postgresql
+          image: busybox
+          imagePullPolicy: IfNotPresent
+          command:
+            - sh
+            - -c
+            - |
+              until printf "." && nc -z -w 2 postgres 5432; do
+                  sleep 2;
+              done;
+
+              echo 'PostgreSQL OK ✓'
+      containers:
+        - name: keycloak
+          image: jboss/keycloak:4.8.3.Final
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: keycloak
+            - configMapRef:
+                name: keycloak
+          livenessProbe:
+            httpGet:
+              path: /auth
+              port: http
+            initialDelaySeconds: 120
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: auth/realms/master
+              port: http
+            initialDelaySeconds: 30
+            timeoutSeconds: 1
+#          volumeMounts:
+#            - mountPath: /opt/jboss/keycloak/standalone/data
+#              name: keycloak-data-volume
+#              readOnly: false
+#            - mountPath: "/etc/x509/https"
+#              name: tls-config-volume
+#              readOnly: true
+#            - mountPath: /opt/jboss/keycloak/standalone/configuration/import
+#              name: keycloak-import-volume
+#              readOnly: true
+#      volumes:
+#        - name: keycloak-data-volume
+#          persistentVolumeClaim:
+#            claimName: keycloak
+#        - name: tls-config-volume
+#          secret:
+#            secretName: keycloak-secrets-tls
+#        - name: keycloak-import-volume
+#          configMap:
+#            defaultMode: 0420
+#            name: keycloak-config-imports
+#            items:
+#              - key: realm-export.json
+#                path: realm-export.json
+#              - key: standalone.xml
+#                path: standalone.xml
diff --git a/.deploy/keycloak/05-keycloak-service-nodeport.yaml b/.deploy/keycloak/05-keycloak-service-nodeport.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  type: NodePort
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: http
+      nodePort: 31080
+  selector:
+    app: keycloak
diff --git a/.deploy/keycloak/05-keycloak-service.yaml b/.deploy/keycloak/05-keycloak-service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+  selector:
+    app: keycloak
diff --git a/.deploy/keycloak/06-keycloak-network-policy.yaml b/.deploy/keycloak/06-keycloak-network-policy.yaml
@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak
+  labels:
+    app: keycloak
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 8080
diff --git a/.deploy/keycloak/07-keycloak-ingress.yaml b/.deploy/keycloak/07-keycloak-ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: keycloak-ingress
+  labels:
+    app: keycloak
+spec:
+  to:
+    kind: Service
+    name: keycloak
+  port:
+    targetPort: http
+  tls:
+    - hosts:
+      - keycloak.example.com
+      secretName: keycloak-secrets-tls
+  rules:
+    - host: keycloak.example.com
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: keycloak
+              servicePort: http
diff --git a/.deploy/keycloak/keycloak-openshift.yaml b/.deploy/keycloak/keycloak-openshift.yaml
@@ -0,0 +1,143 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      annotations: {}
+      name: keycloak-data
+      labels:
+        app: keycloak
+    spec:
+#      storageClassName: nas-thin
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: 2Gi
+
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      labels:
+        app: keycloak
+      name: keycloak-config
+    data:
+      keycloak_user: admin
+      db_vendor: H2
+
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: keycloak-secrets
+      labels:
+        app: keycloak
+    stringData:
+      keycloak_password: admin123
+
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: keycloak
+      labels:
+        app: keycloak
+    spec:
+      ports:
+        - name: keycloak-8080-http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+      selector:
+        app: keycloak
+
+  - apiVersion: route.openshift.io/v1
+    kind: Route
+    metadata:
+      name: keycloak
+      labels:
+        expose: "true"
+        app: keycloak
+    spec:
+      to:
+        kind: Service
+        name: keycloak
+      port:
+        targetPort: keycloak-8080-http
+      tls:
+        termination: edge
+
+  - apiVersion: apps.openshift.io/v1
+    kind: DeploymentConfig
+    metadata:
+      name: keycloak
+      labels:
+        app: keycloak
+    spec:
+      replicas: 1
+      strategy:
+        type: Rolling
+      triggers:
+        - type: ConfigChange
+      template:
+        metadata:
+          name: keycloak
+          labels:
+            app: keycloak
+        spec:
+          containers:
+            - name: keycloak
+              image: docker.io/jboss/keycloak:4.8.3.Final
+              imagePullPolicy: IfNotPresent
+              resources:
+                limits:
+                  memory: 4G
+                requests:
+                  memory: 2G
+              ports:
+                - containerPort: 8080
+              env:
+                - name: POD_NAMESPACE
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: metadata.namespace
+                - name: KEYCLOAK_USER
+                  valueFrom:
+                    configMapKeyRef:
+                      name: keycloak-config
+                      key: keycloak_user
+                - name: KEYCLOAK_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: keycloak-secrets
+                      key: keycloak_password
+                - name: PROXY_ADDRESS_FORWARDING
+                  value: "true"
+              livenessProbe:
+                httpGet:
+                  path: /auth/realms/master
+                  port: 8080
+                  scheme: HTTP
+                initialDelaySeconds: 60
+                timeoutSeconds: 10
+                failureThreshold: 3
+              readinessProbe:
+                httpGet:
+                  path: /auth/realms/master
+                  port: 8080
+                  scheme: HTTP
+                initialDelaySeconds: 10
+                timeoutSeconds: 10
+                failureThreshold: 3
+              volumeMounts:
+                - mountPath: /opt/jboss/keycloak/standalone/data
+                  name: keycloak-data
+                  readOnly: false
+          securityContext:
+            privileged: false
+          volumes:
+            - name: keycloak-data
+              persistentVolumeClaim:
+                claimName: keycloak-data
+
+