keycloak-https.json

{
    "kind": "Template",
    "apiVersion": "v1",
    "metadata": {
        "name": "keycloak-https",
        "annotations": {
            "iconClass": "icon-sso",
            "tags": "keycloak",
            "version": "4.0.0.Beta2",
            "openshift.io/display-name": "Keycloak",
            "description": "An example Keycloak server with HTTPS"
        }
    },
    "parameters": [
        {
            "displayName": "Application Name",
            "description": "The name for the application.",
            "name": "APPLICATION_NAME",
            "value": "keycloak",
            "required": true
        },
        {
            "displayName": "Keycloak Administrator Username",
            "description": "Keycloak Server administrator username",
            "name": "KEYCLOAK_USER",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "displayName": "Keycloak Administrator Password",
            "description": "Keycloak Server administrator password",
            "name": "KEYCLOAK_PASSWORD",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "displayName": "DB Vendor",
            "description": "DB vendor (H2, POSTGRES, MYSQL or MARIADB)",
            "name": "DB_VENDOR",
            "value": "H2",
            "required": true
        },
        {
            "displayName": "Proxy Address Forwarding",
            "description": "Enable proxy address forwarding",
            "name": "PROXY_ADDRESS_FORWARDING",
            "value": "true",
            "required": true
        },
        {
            "displayName": "Keycloak log level",
            "description": "Keycloak log level",
            "name": "KEYCLOAK_LOGLEVEL",
            "value": "DEBUG",
            "required": true
        },
        {
            "displayName": "Custom http Route Hostname",
            "description": "Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>.<project>.<default-domain-suffix>",
            "name": "HOSTNAME_HTTP",
            "value": "",
            "required": false
        },
        {
            "displayName": "Custom https Route Hostname",
            "description": "Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>.<project>.<default-domain-suffix>",
            "name": "HOSTNAME_HTTPS",
            "value": "",
            "required": false
        }
    ],
    "objects": [
        {
            "apiVersion": "v1",
            "kind": "PersistentVolumeClaim",
            "metadata": {
                "name": "keycloak-data"
            },
            "spec": {
                "accessModes": [ "ReadWriteOnce" ],
                "resources": {
                    "requests": {
                        "storage": "1Gi"
                    }
                }
            }
        },
        {
            "kind": "Service",
            "apiVersion": "v1",
            "spec": {
                "ports": [
                    {
                        "port": 8443,
                        "targetPort": 8443
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                }
            },
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "The web server's https port."
                }
            }
        },
        {
            "kind": "Route",
            "apiVersion": "v1",
            "id": "${APPLICATION_NAME}",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "Route for application's https service."
                }
            },
            "spec": {
                "host": "${HOSTNAME_HTTPS}",
                "to": {
                    "name": "${APPLICATION_NAME}"
                },
                "tls": {
                    "termination": "passthrough"
                }
            }
        },
        {
            "kind": "DeploymentConfig",
            "apiVersion": "v1",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                }
            },
            "spec": {
                "strategy": {
                    "type": "Recreate"
                },
                "triggers": [
                    {
                        "type": "ConfigChange"
                    }
                ],
                "replicas": 1,
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                },
                "template": {
                    "metadata": {
                        "name": "${APPLICATION_NAME}",
                        "labels": {
                            "deploymentConfig": "${APPLICATION_NAME}",
                            "application": "${APPLICATION_NAME}"
                        }
                    },
                    "spec": {
                        "containers": [
                            {
                                "name": "${APPLICATION_NAME}",
                                "image": "jboss/keycloak:nightly-openshift-integration2",
                                "imagePullPolicy": "Always",
                                "args": ["-Djavax.net.debug=ssl:handshake:verbose", "-b", "0.0.0.0", "--debug"],
                                "ports": [
                                    {
                                        "containerPort": 8080,
                                        "protocol": "TCP"
                                    },
                                    {
                                        "name": "https",
                                        "containerPort": 8443,
                                        "protocol": "TCP"
                                    }
                                ],
                                "env": [
                                    {
                                        "name": "KEYCLOAK_USER",
                                        "value": "${KEYCLOAK_USER}"
                                    },
                                    {
                                        "name": "KEYCLOAK_PASSWORD",
                                        "value": "${KEYCLOAK_PASSWORD}"
                                    },
                                    {
                                        "name": "DB_VENDOR",
                                        "value": "${DB_VENDOR}"
                                    },
                                    {
                                        "name": "PROXY_ADDRESS_FORWARDING",
                                        "value": "${PROXY_ADDRESS_FORWARDING}"
                                    },
                                    {
                                        "name": "KEYCLOAK_LOGLEVEL",
                                        "value": "${KEYCLOAK_LOGLEVEL}"
                                    },
                                    {
                                        "name": "X509_CA_BUNDLE",
                                        "value": "/etc/x509/client/tls.crt"
                                    }
                                ],
                                "securityContext": {
                                    "privileged": false
                                },
                                "readinessProbe": {
                                    "httpGet": {
                                        "path": "/auth/realms/master",
                                        "port": 8080
                                    },
                                    "initialDelaySeconds": 10,
                                    "periodSeconds": 10,
                                    "timeoutSeconds": 1,
                                    "failureThreshold": 5
                                },
                                "volumeMounts": [
                                    {
                                        "name": "keycloak-data",
                                        "mountPath": "/opt/jboss/keycloak/standalone/data",
                                        "readOnly": false
                                    }, {
                                        "name": "keycloak-server-tls-volume",
                                        "mountPath": "/etc/x509/https",
                                        "readOnly": true
                                    },
                                    {
                                        "name": "keycloak-client-tls-volume",
                                        "mountPath": "/etc/x509/client",
                                        "readOnly": true
                                    }
                                ]
                            }
                        ],
                        "volumes": [
                            {
                                "name": "keycloak-server-tls-volume",
                                "secret": {
                                    "secretName": "keycloak-server-tls"
                                }
                            },
                            {
                                "name": "keycloak-client-tls-volume",
                                "secret": {
                                    "secretName": "keycloak-client-tls"
                                }
                            },
                            {
                                "name": "keycloak-data",
                                "persistentVolumeClaim": {
                                    "claimName": "keycloak-data"
                                }
                            }
                        ]
                    }
                }
            }
        }
    ]
}