keycloak

Helm chart

iamguarded

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

# This file has been modified by Chainguard, Inc.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

global:

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## @param global.imageRegistry Global Docker Image registry

## @param global.imagePullSecrets Global Docker registry secret names as an array

imageRegistry: ""

imagePullSecrets: []

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

defaultStorageClass: ""

## Security parameters

## @param global.security.allowInsecureImages Allows skipping image verification

security:

allowInsecureImages: false

## Compatibility adaptations for Kubernetes platforms

compatibility:

## Compatibility adaptations for Openshift

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

openshift:

adaptSecurityContext: auto

## @param global.compatibility.omitEmptySeLinuxOptions If set to true, removes the seLinuxOptions from the securityContexts when it is set to an empty object

omitEmptySeLinuxOptions: false

org: ""

## @section Common parameters

## @param kubeVersion Override Kubernetes version reported by .Capabilities

kubeVersion: ""

## @param apiVersions Override Kubernetes API versions reported by .Capabilities

apiVersions: []

## @param nameOverride String to partially override common.names.name

nameOverride: ""

## @param fullnameOverride String to fully override common.names.fullname

fullnameOverride: ""

## @param namespaceOverride String to fully override common.names.namespace

namespaceOverride: ""

## @param commonLabels Labels to add to all deployed objects

commonLabels: {}

## @param commonAnnotations Annotations to add to all deployed objects

commonAnnotations: {}

## @param clusterDomain Default Kubernetes cluster domain

clusterDomain: cluster.local

## @param extraDeploy Array of extra objects to deploy with the release

extraDeploy: []

## Diagnostic mode

## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)

## @param diagnosticMode.command Command to override all containers in the chart release

## @param diagnosticMode.args Args to override all containers in the chart release

diagnosticMode:

enabled: false

command:

- sleep

args:

- infinity

## @param useHelmHooks Enable use of Helm hooks if needed, e.g. on post-install jobs

useHelmHooks: true

## @param usePasswordFiles Mount credentials as files instead of using environment variables

usePasswordFiles: true

## @section Keycloak parameters

## Iamguarded Keycloak image version

## @param image.registry [default: REGISTRY_NAME] Keycloak image registry

## @param image.repository [default: REPOSITORY_NAME/keycloak] Keycloak image repository

## @skip image.tag Keycloak image tag (immutable tags are recommended)

## @param image.digest Keycloak image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param image.pullPolicy Keycloak image pull policy

## @param image.pullSecrets Keycloak image pull secrets

## @param image.debug Enable Keycloak image debug mode

image:

registry: cgr.dev

repository: chainguard-private/keycloak-iamguarded

100

tag: 26.7.0

101

digest: ""

102

## Specify a imagePullPolicy

103

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

104

105

pullPolicy: IfNotPresent

106

## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)

107

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

108

## e.g:

109

## pullSecrets:

110

## - myRegistryKeySecretName

111

112

pullSecrets: []

113

debug: false

114

## Keycloak authentication parameters

115

116

auth:

117

## @param auth.adminUser Keycloak administrator user

118

119

adminUser: user

120

## @param auth.adminPassword Keycloak administrator password for the new user

121

122

adminPassword: ""

123

## @param auth.existingSecret Existing secret containing Keycloak admin password

124

125

existingSecret: ""

126

## @param auth.passwordSecretKey Key where the Keycloak admin password is being stored inside the existing secret.

127

128

passwordSecretKey: ""

129

## @param auth.annotations Additional custom annotations for Keycloak auth secret object

130

131

annotations: {}

132

## @param production Run Keycloak in production mode. TLS configuration is required except when using proxy headers

133

134

production: false

135

## HTTPS settings

136

137

## @param tls.enabled Enable TLS in Keycloak

138

## @param tls.usePemCerts Use PEM certificates as input instead of PKS12/JKS stores

139

## @param tls.autoGenerated.enabled Enable automatic generation of TLS certificates

140

## @param tls.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager)

141

## @param tls.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine)

142

## @param tls.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine)

143

## @param tls.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine)

144

## @param tls.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine)

145

## @param tls.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine)

146

## @param tls.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine)

147

## @param tls.existingSecret The name of an existing Secret containing the TLS certificates for Keycloak replicas

148

## @param tls.certFilename Certificate filename inside the existing secret (when tls.usePemCerts=true and tls.autoGenerated.enabled=false)

149

## @param tls.certKeyFilename Certificate key filename inside the existing secret (when tls.usePemCerts=true and tls.autoGenerated.enabled=false)

150

## @param tls.keystoreFilename Keystore filename inside the existing secret

151

## @param tls.truststoreFilename Truststore filename inside the existing secret

152

## @param tls.keystorePassword Password to access the keystore when it's password-protected

153

## @param tls.truststorePassword Password to access the truststore when it's password-protected

154

## @param tls.passwordsSecret The name of an existing Secret containing the keystore/truststore passwords (expected keys: `tls-keystore-password` and `tls-truststore-password`)

155

156

tls:

157

enabled: false

158

usePemCerts: false

159

autoGenerated:

160

enabled: true

161

engine: helm

162

certManager:

163

existingIssuer: ""

164

existingIssuerKind: ""

165

keySize: 2048

166

keyAlgorithm: RSA

167

duration: 2160h

168

renewBefore: 360h

169

## Create this secret following the steps below:

170

## 1) Generate your truststore and keystore files (more info at https://www.keycloak.org/server/enabletls)

171

## 2) Rename your truststore to `keycloak.truststore.jks`

172

## 3) Rename your keystores to `keycloak.keystore.jks`

173

## 4) Run the command below where SECRET_NAME is the name of the secret you want to create:

174

## kubectl create secret generic SECRET_NAME --from-file=./keycloak.truststore.jks --from-file=./keycloak.keystore.jks

175

## NOTE: If tls.usePemCerts enabled, make sure the PEM key and cert are named 'tls.key' and 'tls.crt' respectively.

176

177

existingSecret: ""

178

certFilename: "tls.crt"

179

certKeyFilename: "tls.key"

180

keystoreFilename: "keycloak.keystore.jks"

181

truststoreFilename: "keycloak.truststore.jks"

182

keystorePassword: ""

183

truststorePassword: ""

184

passwordsSecret: ""

185

## Keycloak management interface (health/metrics), listening on containerPorts.management (9000)

186

## ref: https://www.keycloak.org/server/management-interface

187

## @param managementInterface.scheme Scheme for the management interface and its health probes. Empty ("", the default) preserves the chart's legacy behavior: probes use HTTP and KC_HTTP_MANAGEMENT_SCHEME is left unset (Keycloak's own default applies). Set to "inherited" to serve HTTPS on port 9000 when tls.enabled (the health probes switch to HTTPS to match); set to "http" to force plaintext. Maps to KC_HTTP_MANAGEMENT_SCHEME

188

## @param managementInterface.clientAuth Mutual-TLS client-certificate policy for the management interface: none, request or required. Emitted only when scheme=inherited and tls.enabled; "none" lets health/metrics probes connect without a client certificate even when the main server enables mTLS (KC_HTTPS_CLIENT_AUTH). Maps to KC_HTTPS_MANAGEMENT_CLIENT_AUTH

189

## @param managementInterface.tls.certFilename Optional dedicated PEM certificate filename (inside the TLS secret) for the management listener, decoupling it from the main server's mTLS context. Empty inherits the main certificate. Used only when scheme=inherited. Maps to KC_HTTPS_MANAGEMENT_CERTIFICATE_FILE

190

## @param managementInterface.tls.certKeyFilename Optional dedicated PEM key filename for the management listener. Maps to KC_HTTPS_MANAGEMENT_CERTIFICATE_KEY_FILE

191

192

managementInterface:

193

scheme: ""

194

clientAuth: "none"

195

tls:

196

certFilename: ""

197

certKeyFilename: ""

198

## @param trustedCertsExistingSecret Name of the existing Secret containing the trusted certificates to validate communications with external services

199

## ref: https://www.keycloak.org/server/keycloak-truststore

200

201

trustedCertsExistingSecret: ""

202

## @param adminRealm Name of the admin realm

203

204

adminRealm: "master"

205

## @param proxyHeaders Set Keycloak proxy headers

206

207

proxyHeaders: ""

208

## @param hostnameStrict Disables dynamically resolving the hostname from request headers (ignored if ingress.enabled is false).

209

## Should always be set to true in production, unless your reverse proxy overwrites the Host header.

210

## If enabled, the ingress.hostname option needs to be specified.

211

212

hostnameStrict: false

213

## @param httpEnabled Force enabling HTTP endpoint (by default is only enabled if TLS is disabled)

214

215

httpEnabled: false

216

## @param httpRelativePath Set the path relative to '/' for serving resources

217

218

httpRelativePath: "/"

219

## Keycloak cache configuration

220

## ref: https://www.keycloak.org/server/caching

221

## @param cache.enabled Switch to enable or disable the Keycloak distributed cache for kubernetes.

222

## NOTE: Set to false to use 'local' cache (only supported when replicaCount=1).

223

## @param cache.stack Cache stack to use

224

## @param cache.configFile Path to the file from which cache configuration should be loaded from

225

## @param cache.useHeadlessServiceWithAppVersion Create a headless service used for ispn containing the app version

226

## @param cache.javaOptsAppendExtra Extra java options to append to the java options

227

228

cache:

229

enabled: true

230

stack: jdbc-ping

231

configFile: "cache-ispn.xml"

232

useHeadlessServiceWithAppVersion: false

233

javaOptsAppendExtra: ""

234

## Keycloak logging configuration

235

## ref: https://www.keycloak.org/server/logging

236

## @param logging.output Alternates between the default log output format or json format

237

## @param logging.level Allowed values as documented: FATAL, ERROR, WARN, INFO, DEBUG, TRACE, ALL, OFF

238

239

logging:

240

output: default

241

level: INFO

242

## @param configuration Keycloak Configuration. Auto-generated based on other parameters when not specified

243

## NOTE: This will override configuring Keycloak based on environment variables (including those set by the chart)

244

## The keycloak.conf is auto-generated based on other parameters when this parameter is not specified

245

246

## Example:

247

## configuration: |-

248

## foo: bar

249

## baz:

250

251

configuration: ""

252

## @param existingConfigmap Name of existing ConfigMap with Keycloak configuration

253

## NOTE: When it's set the configuration parameter is ignored

254

255

existingConfigmap: ""

256

## @param extraStartupArgs Extra default startup args

257

258

extraStartupArgs: ""

259

## @param initdbScripts Dictionary of initdb scripts

260

## Specify dictionary of scripts to be run at first boot

261

## Example:

262

## initdbScripts:

263

## my_init_script.sh: |

264

## #!/bin/bash

265

## echo "Do something."

266

267

initdbScripts: {}

268

## @param initdbScriptsConfigMap ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`)

269

270

initdbScriptsConfigMap: ""

271

## @param command Override default container command (useful when using custom images)

272

273

command: []

274

## @param args Override default container args (useful when using custom images)

275

276

args: []

277

## @param extraEnvVars Extra environment variables to be set on Keycloak container

278

## Example:

279

## extraEnvVars:

280

## - name: FOO

281

## value: "bar"

282

283

extraEnvVars: []

284

## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars

285

286

extraEnvVarsCM: ""

287

## @param extraEnvVarsSecret Name of existing Secret containing extra env vars

288

289

extraEnvVarsSecret: ""

290

## @param containerPorts.http Keycloak HTTP container port

291

## @param containerPorts.https Keycloak HTTPS container port

292

## @param containerPorts.management Keycloak management container port

293

294

containerPorts:

295

http: 8080

296

https: 8443

297

management: 9000

298

## @param extraContainerPorts Optionally specify extra list of additional ports for Keycloak container

299

## e.g:

300

## extraContainerPorts:

301

## - name: myservice

302

## containerPort: 9090

303

304

extraContainerPorts: []

305

## Keycloak pods' SecurityContext

306

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

307

## @param podSecurityContext.enabled Enabled Keycloak pods' Security Context

308

## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

309

## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface

310

## @param podSecurityContext.supplementalGroups Set filesystem extra groups

311

## @param podSecurityContext.fsGroup Set Keycloak pod's Security Context fsGroup

312

313

podSecurityContext:

314

enabled: true

315

fsGroupChangePolicy: Always

316

sysctls: []

317

supplementalGroups: []

318

fsGroup: 1001

319

## Keycloak containers' Security Context

320

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

321

## @param containerSecurityContext.enabled Enabled containers' Security Context

322

## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

323

## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser

324

## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup

325

## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot

326

## @param containerSecurityContext.privileged Set container's Security Context privileged

327

## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem

328

## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation

329

## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped

330

## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

331

332

containerSecurityContext:

333

enabled: true

334

seLinuxOptions: {}

335

runAsUser: 1001

336

runAsGroup: 1001

337

runAsNonRoot: true

338

privileged: false

339

readOnlyRootFilesystem: true

340

allowPrivilegeEscalation: false

341

capabilities:

342

drop: ["ALL"]

343

seccompProfile:

344

type: "RuntimeDefault"

345

## Keycloak resource requests and limits

346

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

347

## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).

348

349

resourcesPreset: "small"

350

## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

351

## Example:

352

## resources:

353

## requests:

354

## cpu: 2

355

## memory: 512Mi

356

## limits:

357

## cpu: 3

358

## memory: 1024Mi

359

360

resources: {}

361

## Configure extra options for Keycloak containers' liveness, readiness and startup probes

362

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes

363

## @param livenessProbe.enabled Enable livenessProbe on Keycloak containers

364

## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

365

## @param livenessProbe.periodSeconds Period seconds for livenessProbe

366

## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

367

## @param livenessProbe.failureThreshold Failure threshold for livenessProbe

368

## @param livenessProbe.successThreshold Success threshold for livenessProbe

369

370

livenessProbe:

371

enabled: true

372

initialDelaySeconds: 120

373

periodSeconds: 1

374

timeoutSeconds: 5

375

failureThreshold: 3

376

successThreshold: 1

377

## @param readinessProbe.enabled Enable readinessProbe on Keycloak containers

378

## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

379

## @param readinessProbe.periodSeconds Period seconds for readinessProbe

380

## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

381

## @param readinessProbe.failureThreshold Failure threshold for readinessProbe

382

## @param readinessProbe.successThreshold Success threshold for readinessProbe

383

384

readinessProbe:

385

enabled: true

386

initialDelaySeconds: 30

387

periodSeconds: 10

388

timeoutSeconds: 1

389

failureThreshold: 3

390

successThreshold: 1

391

## @param startupProbe.enabled Enable startupProbe on Keycloak containers

392

## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

393

## @param startupProbe.periodSeconds Period seconds for startupProbe

394

## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe

395

## @param startupProbe.failureThreshold Failure threshold for startupProbe

396

## @param startupProbe.successThreshold Success threshold for startupProbe

397

398

startupProbe:

399

enabled: false

400

initialDelaySeconds: 30

401

periodSeconds: 5

402

timeoutSeconds: 1

403

failureThreshold: 10

404

successThreshold: 1

405

## @param customLivenessProbe Custom Liveness probes for Keycloak

406

407

customLivenessProbe: {}

408

## @param customReadinessProbe Custom Readiness probes Keycloak

409

410

customReadinessProbe: {}

411

## @param customStartupProbe Custom Startup probes for Keycloak

412

413

customStartupProbe: {}

414

## @section Keycloak StatefulSet parameters

415

416

## @param replicaCount Number of Keycloak replicas to deploy

417

418

replicaCount: 1

419

## @param updateStrategy.type Keycloak StatefulSet type

420

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

421

422

updateStrategy:

423

## Can be set to RollingUpdate or OnDelete

424

425

type: RollingUpdate

426

## @param revisionHistoryLimitCount Number of controller revisions to keep

427

428

revisionHistoryLimitCount: 10

429

## @param minReadySeconds How many seconds a pod needs to be ready before killing the next, during update

430

431

minReadySeconds: 0

432

## @param statefulsetAnnotations Optionally add extra annotations on the StatefulSet resource

433

434

statefulsetAnnotations: {}

435

## @param automountServiceAccountToken Mount Service Account token in Keycloak pods

436

437

automountServiceAccountToken: true

438

## @param hostAliases Deployment pod host aliases

439

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

440

441

hostAliases: []

442

## @param podLabels Extra labels for Keycloak pods

443

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

444

445

podLabels: {}

446

## @param podAnnotations Annotations for Keycloak pods

447

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

448

449

podAnnotations: {}

450

## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

451

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

452

453

podAffinityPreset: ""

454

## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

455

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

456

457

podAntiAffinityPreset: soft

458

## Node affinity preset

459

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

460

461

nodeAffinityPreset:

462

## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

463

464

type: ""

465

## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set.

466

## E.g.

467

## key: "kubernetes.io/e2e-az-name"

468

469

key: ""

470

## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set.

471

## E.g.

472

## values:

473

## - e2e-az1

474

## - e2e-az2

475

476

values: []

477

## @param affinity Affinity for pod assignment

478

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

479

480

affinity: {}

481

## @param nodeSelector Node labels for pod assignment

482

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

483

484

nodeSelector: {}

485

## @param tolerations Tolerations for pod assignment

486

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

487

488

tolerations: []

489

## @param topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template

490

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

491

492

topologySpreadConstraints: []

493

## @param podManagementPolicy Pod management policy for the Keycloak StatefulSet

494

495

podManagementPolicy: Parallel

496

## @param priorityClassName Keycloak pods' Priority Class Name

497

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

498

499

priorityClassName: ""

500

## @param schedulerName Use an alternate scheduler, e.g. "stork".

501

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

502

503

schedulerName: ""

504

## @param terminationGracePeriodSeconds Seconds Keycloak pod needs to terminate gracefully

505

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

506

507

terminationGracePeriodSeconds: ""

508

## @param lifecycleHooks LifecycleHooks to set additional configuration at startup

509

510

lifecycleHooks: {}

511

## @param dnsPolicy DNS Policy for pod

512

## @param dnsConfig DNS Configuration pod

513

## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/

514

515

dnsPolicy: ""

516

dnsConfig: {}

517

## @param enableServiceLinks If set to false, disable Kubernetes service links in the pod spec

518

## Ref: https://kubernetes.io/docs/tutorials/services/connect-applications-service/#accessing-the-service

519

520

enableServiceLinks: true

521

## @param extraVolumes Optionally specify extra list of additional volumes for Keycloak pods

522

523

extraVolumes: []

524

## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for Keycloak container(s)

525

526

extraVolumeMounts: []

527

## @param initContainers Add additional init containers to the Keycloak pods

528

## Example:

529

## initContainers:

530

## - name: your-image-name

531

## image: your-image

532

## imagePullPolicy: Always

533

## ports:

534

## - name: portname

535

## containerPort: 1234

536

537

initContainers: []

538

## @param sidecars Add additional sidecar containers to the Keycloak pods

539

## Example:

540

## sidecars:

541

## - name: your-image-name

542

## image: your-image

543

## imagePullPolicy: Always

544

## ports:

545

## - name: portname

546

## containerPort: 1234

547

548

sidecars: []

549

## @section Traffic Exposure Parameters

550

551

## Service configuration

552

553

service:

554

## @param service.type Kubernetes service type

555

556

type: ClusterIP

557

## @param service.http.enabled Enable http port on service

558

559

http:

560

enabled: true

561

## @param service.ports.http Keycloak service HTTP port

562

## @param service.ports.https Keycloak service HTTPS port

563

564

ports:

565

http: 80

566

https: 443

567

## Node ports to expose

568

## @param service.nodePorts.http Node port for HTTP

569

## @param service.nodePorts.https Node port for HTTPS

570

## NOTE: choose port between <30000-32767>

571

572

nodePorts:

573

http: ""

574

https: ""

575

## @param service.extraPorts Extra port to expose on Keycloak service

576

577

extraPorts: []

578

## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin

579

## Values: ClientIP or None

580

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

581

582

sessionAffinity: None

583

## @param service.sessionAffinityConfig Additional settings for the sessionAffinity

584

## sessionAffinityConfig:

585

## clientIP:

586

## timeoutSeconds: 300

587

588

sessionAffinityConfig: {}

589

## @param service.clusterIP Keycloak service clusterIP IP

590

## e.g:

591

## clusterIP: None

592

593

clusterIP: ""

594

## @param service.loadBalancerIP loadBalancerIP for the SuiteCRM Service (optional, cloud specific)

595

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

596

597

loadBalancerIP: ""

598

## @param service.loadBalancerSourceRanges Address that are allowed when service is LoadBalancer

599

## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

600

## Example:

601

## loadBalancerSourceRanges:

602

## - 10.10.10.0/24

603

604

loadBalancerSourceRanges: []

605

## @param service.externalTrafficPolicy Enable client source IP preservation

606

## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

607

608

externalTrafficPolicy: Cluster

609

## @param service.annotations Additional custom annotations for Keycloak service

610

611

annotations: {}

612

## Headless service properties

613

614

headless:

615

## @param service.headless.annotations Annotations for the headless service.

616

617

annotations: {}

618

## @param service.headless.extraPorts Extra ports to expose on Keycloak headless service

619

620

extraPorts: []

621

## Keycloak ingress parameters

622

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/

623

624

ingress:

625

## @param ingress.enabled Enable ingress record generation for Keycloak

626

627

enabled: false

628

## @param ingress.pathType Ingress path type

629

630

pathType: ImplementationSpecific

631

## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)

632

633

apiVersion: ""

634

## @param ingress.hostname Default host for the ingress record (evaluated as template)

635

636

hostname: keycloak.local

637

## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (evaluated as template)

638

## Required if you have more than one IngressClass marked as the default for your cluster

639

640

ingressClassName: ""

641

## @param ingress.controller The ingress controller type. Currently supports `default` and `gce`

642

## leave as `default` for most ingress controllers.

643

## set to `gce` if using the GCE ingress controller

644

645

controller: default

646

## @param ingress.path Default path for the ingress record

647

648

path: "{{ .Values.httpRelativePath }}"

649

## @param ingress.servicePort Backend service port to use

650

## Default is http. Alternative is https.

651

652

servicePort: http

653

## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

654

## Use this parameter to set the required annotations for cert-manager, see

655

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

656

## e.g:

657

## annotations:

658

## kubernetes.io/ingress.class: nginx

659

## cert-manager.io/cluster-issuer: cluster-issuer-name

660

661

annotations: {}

662

## @param ingress.labels Additional labels for the Ingress resource.

663

## e.g:

664

## labels:

665

## app: keycloak

666

667

labels: {}

668

## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

669

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" (tpl .Values.ingress.hostname .) }}`

670

## You can:

671

## - Use the `ingress.secrets` parameter to create this TLS secret

672

## - Rely on cert-manager to create it by setting the corresponding annotations

673

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

674

675

tls: false

676

## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

677

678

selfSigned: false

679

## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

680

## e.g:

681

## extraHosts:

682

## - name: keycloak.local

683

## path: /

684

685

extraHosts: []

686

## @param ingress.extraPaths Any additional arbitrary paths that may need to be added to the ingress under the main host.

687

## For example: The ALB ingress controller requires a special rule for handling SSL redirection.

688

## extraPaths:

689

## - path: /*

690

## backend:

691

## serviceName: ssl-redirect

692

## servicePort: use-annotation

693

694

extraPaths: []

695

## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.

696

## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

697

## extraTls:

698

## - hosts:

699

## - keycloak.local

700

## secretName: keycloak.local-tls

701

702

extraTls: []

703

## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets

704

## key and certificate should start with -----BEGIN CERTIFICATE----- or

705

## -----BEGIN RSA PRIVATE KEY-----

706

707

## name should line up with a tlsSecret set further up

708

## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set

709

710

## It is also possible to create and manage the certificates outside of this helm chart

711

## Please see README.md for more information

712

## e.g:

713

## - name: keycloak.local-tls

714

## key:

715

## certificate:

716

717

secrets: []

718

## @param ingress.extraRules Additional rules to be covered with this ingress record

719

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

720

## e.g:

721

## extraRules:

722

## - host: keycloak.local

723

## http:

724

## path: /

725

## backend:

726

## service:

727

## name: keycloak

728

## port:

729

## name: http

730

731

extraRules: []

732

## Network Policy configuration

733

## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

734

735

networkPolicy:

736

## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created

737

738

enabled: true

739

## @param networkPolicy.allowExternal Don't require server label for connections

740

## The Policy model to apply. When set to false, only pods with the correct

741

## server label will have network access to the ports server is listening

742

## on. When true, server will accept connections from any source

743

## (with the correct destination port).

744

745

allowExternal: true

746

## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

747

748

allowExternalEgress: true

749

## @param networkPolicy.addExternalClientAccess Allow access from pods with client label set to "true". Ignored if `networkPolicy.allowExternal` is true.

750

751

addExternalClientAccess: true

752

## @param networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)

753

754

kubeAPIServerPorts: [443, 6443, 8443]

755

## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

756

## e.g:

757

## extraIngress:

758

## - ports:

759

## - port: 1234

760

## from:

761

## - podSelector:

762

## - matchLabels:

763

## - role: frontend

764

## - podSelector:

765

## - matchExpressions:

766

## - key: role

767

## operator: In

768

## values:

769

## - frontend

770

extraIngress: []

771

## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

772

## e.g:

773

## extraEgress:

774

## - ports:

775

## - port: 1234

776

## to:

777

## - podSelector:

778

## - matchLabels:

779

## - role: frontend

780

## - podSelector:

781

## - matchExpressions:

782

## - key: role

783

## operator: In

784

## values:

785

## - frontend

786

787

extraEgress: []

788

## @param networkPolicy.ingressPodMatchLabels [object] Labels to match to allow traffic from other pods. Ignored if `networkPolicy.allowExternal` is true.

789

## e.g:

790

## ingressPodMatchLabels:

791

## my-client: "true"

792

793

ingressPodMatchLabels: {}

794

## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

795

## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

796

797

ingressNSMatchLabels: {}

798

ingressNSPodMatchLabels: {}

799

## @section Other parameters

800

801

## ServiceAccount configuration

802

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

803

804

serviceAccount:

805

## @param serviceAccount.create Specifies whether a ServiceAccount should be created

806

807

create: true

808

## @param serviceAccount.name The name of the ServiceAccount to use.

809

## If not set and create is true, a name is generated using the common.names.fullname template

810

811

name: ""

812

## @param serviceAccount.annotations Additional Service Account annotations (evaluated as a template)

813

814

annotations: {}

815

## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account

816

817

automountServiceAccountToken: true

818

## @param serviceAccount.extraLabels Additional Service Account labels (evaluated as a template)

819

820

extraLabels: {}

821

## Keycloak Pod Disruption Budget configuration

822

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

823

## @param pdb.create Enable/disable a Pod Disruption Budget creation

824

## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

825

## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.

826

827

pdb:

828

create: true

829

minAvailable: ""

830

maxUnavailable: ""

831

## Keycloak Autoscaling configuration

832

## ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/

833

834

autoscaling:

835

## @param autoscaling.vpa.enabled Enable VPA for Keycloak pods

836

## @param autoscaling.vpa.annotations Annotations for VPA resource

837

## @param autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

838

## @param autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod

839

## @param autoscaling.vpa.minAllowed VPA Min allowed resources for the pod

840

841

vpa:

842

enabled: false

843

annotations: {}

844

controlledResources: []

845

maxAllowed: {}

846

minAllowed: {}

847

## @param autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy

848

## Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod

849

## Possible values are "Off", "Initial", "Recreate", and "Auto".

850

851

updatePolicy:

852

updateMode: Auto

853

## @param autoscaling.hpa.enabled Enable HPA for Keycloak pods

854

## @param autoscaling.hpa.minReplicas Minimum number of Keycloak replicas

855

## @param autoscaling.hpa.maxReplicas Maximum number of Keycloak replicas

856

## @param autoscaling.hpa.targetCPU Target CPU utilization percentage

857

## @param autoscaling.hpa.targetMemory Target Memory utilization percentage

858

859

hpa:

860

enabled: false

861

minReplicas: 1

862

maxReplicas: 11

863

targetCPU: ""

864

targetMemory: ""

865

## HPA Scaling Behavior

866

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configurable-scaling-behavior

867

868

behavior:

869

## HPA behavior when scaling up

870

## @param autoscaling.hpa.behavior.scaleUp.stabilizationWindowSeconds The number of seconds for which past recommendations should be considered while scaling up

871

## @param autoscaling.hpa.behavior.scaleUp.selectPolicy The priority of policies that the autoscaler will apply when scaling up

872

## @param autoscaling.hpa.behavior.scaleUp.policies [array] HPA scaling policies when scaling up

873

## e.g:

874

## Policy to scale 20% of the pod in 60s

875

## - type: Percent

876

## value: 20

877

## periodSeconds: 60

878

879

scaleUp:

880

stabilizationWindowSeconds: 120

881

selectPolicy: Max

882

policies: []

883

## HPA behavior when scaling down

884

## @param autoscaling.hpa.behavior.scaleDown.stabilizationWindowSeconds The number of seconds for which past recommendations should be considered while scaling down

885

## @param autoscaling.hpa.behavior.scaleDown.selectPolicy The priority of policies that the autoscaler will apply when scaling down

886

## @param autoscaling.hpa.behavior.scaleDown.policies [array] HPA scaling policies when scaling down

887

## e.g:

888

## Policy to scale one pod in 300s

889

## - type: Pods

890

## value: 1

891

## periodSeconds: 300

892

893

scaleDown:

894

stabilizationWindowSeconds: 300

895

selectPolicy: Max

896

policies:

897

- type: Pods

898

value: 1

899

periodSeconds: 300

900

## @section Metrics parameters

901

metrics:

902

## @param metrics.enabled Enable exposing Keycloak metrics

903

904

enabled: false

905

## Keycloak metrics service parameters

906

907

service:

908

## @param metrics.service.ports.metrics Metrics service Metrics port

909

910

ports:

911

metrics: 9000

912

## @param metrics.service.annotations [object] Annotations for enabling prometheus to access the metrics endpoints

913

914

annotations:

915

prometheus.io/scrape: "true"

916

prometheus.io/port: "{{ .Values.metrics.service.ports.metrics }}"

917

## @param metrics.service.extraPorts [array] Add additional ports to the keycloak metrics service

918

919

extraPorts: []

920

## Prometheus Operator ServiceMonitor configuration

921

922

serviceMonitor:

923

## @param metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

924

925

enabled: false

926

## @param metrics.serviceMonitor.namespace Namespace in which Prometheus is running

927

928

namespace: ""

929

## @param metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor

930

931

annotations: {}

932

## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

933

934

labels: {}

935

## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

936

937

jobLabel: ""

938

## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

939

940

honorLabels: false

941

## @param metrics.serviceMonitor.tlsConfig [object] TLS configuration used for scrape endpoints used by Prometheus

942

943

tlsConfig: {}

944

## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped.

945

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

946

## e.g:

947

## interval: 10s

948

949

interval: ""

950

## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

951

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

952

## e.g:

953

## scrapeTimeout: 10s

954

955

scrapeTimeout: ""

956

## @param metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

957

958

metricRelabelings: []

959

## @param metrics.serviceMonitor.relabelings Specify general relabeling

960

961

relabelings: []

962

## @param metrics.serviceMonitor.selector Prometheus instance selector labels

963

## selector:

964

## prometheus: my-prometheus

965

966

selector: {}

967

## Prometheus Operator alert rules configuration

968

969

prometheusRule:

970

## @param metrics.prometheusRule.enabled Create PrometheusRule Resource for scraping metrics using PrometheusOperator

971

972

enabled: false

973

## @param metrics.prometheusRule.namespace Namespace which Prometheus is running in

974

975

namespace: ""

976

## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus

977

978

labels: {}

979

## @param metrics.prometheusRule.groups Groups, containing the alert rules.

980

## Example:

981

## groups:

982

## - name: Keycloak

983

## rules:

984

## - alert: KeycloakInstanceNotAvailable

985

## annotations:

986

## message: "Keycloak instance in namespace {{ `{{` }} $labels.namespace {{ `}}` }} has not been available for the last 5 minutes."

987

## expr: |

988

## absent(kube_pod_status_ready{namespace="{{ include "common.names.namespace" . }}", condition="true"} * on (pod) kube_pod_labels{pod=~"{{ include "common.names.fullname" . }}-\\d+", namespace="{{ include "common.names.namespace" . }}"}) != 0

989

## for: 5m

990

## labels:

991

## severity: critical

992

groups: []

993

## @section keycloak-config-cli parameters

994

995

## Configuration for keycloak-config-cli

996

## ref: https://github.com/adorsys/keycloak-config-cli

997

998

keycloakConfigCli:

999

## @param keycloakConfigCli.enabled Whether to enable keycloak-config-cli job

1000

1001

enabled: false

1002

## Iamguarded keycloak-config-cli image

1003

## @param keycloakConfigCli.image.registry [default: REGISTRY_NAME] keycloak-config-cli container image registry

1004

## @param keycloakConfigCli.image.repository [default: REPOSITORY_NAME/keycloak-config-cli] keycloak-config-cli container image repository

1005

## @skip keycloakConfigCli.image.tag keycloak-config-cli container image tag

1006

## @param keycloakConfigCli.image.digest keycloak-config-cli container image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

1007

## @param keycloakConfigCli.image.pullPolicy keycloak-config-cli container image pull policy

1008

## @param keycloakConfigCli.image.pullSecrets keycloak-config-cli container image pull secrets

1009

1010

image:

1011

registry: cgr.dev

1012

repository: chainguard-private/keycloak-config-cli-iamguarded

1013

tag: 6.5.1

1014

digest: ""

1015

## Specify a imagePullPolicy

1016

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

1017

1018

pullPolicy: IfNotPresent

1019

## Optionally specify an array of imagePullSecrets.

1020

## Secrets must be manually created in the namespace.

1021

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

1022

## e.g:

1023

## pullSecrets:

1024

## - myRegistryKeySecretName

1025

1026

pullSecrets: []

1027

## @param keycloakConfigCli.annotations [object] Annotations for keycloak-config-cli job

1028

1029

annotations: {}

1030

## @param keycloakConfigCli.command Command for running the container (set to default if not set). Use array form

1031

1032

command: []

1033

## @param keycloakConfigCli.args Args for running the container (set to default if not set). Use array form

1034

1035

args: []

1036

## @param keycloakConfigCli.automountServiceAccountToken Mount Service Account token in pod

1037

1038

automountServiceAccountToken: true

1039

## @param keycloakConfigCli.hostAliases Job pod host aliases

1040

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1041

1042

hostAliases: []

1043

## Keycloak config CLI resource requests and limits

1044

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1045

## @param keycloakConfigCli.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if keycloakConfigCli.resources is set (keycloakConfigCli.resources is recommended for production).

1046

1047

resourcesPreset: "small"

1048

## @param keycloakConfigCli.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

1049

## Example:

1050

## resources:

1051

## requests:

1052

## cpu: 2

1053

## memory: 512Mi

1054

## limits:

1055

## cpu: 3

1056

## memory: 1024Mi

1057

1058

resources: {}

1059

## keycloak-config-cli containers' Security Context

1060

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

1061

## @param keycloakConfigCli.containerSecurityContext.enabled Enabled keycloak-config-cli Security Context

1062

## @param keycloakConfigCli.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

1063

## @param keycloakConfigCli.containerSecurityContext.runAsUser Set keycloak-config-cli Security Context runAsUser

1064

## @param keycloakConfigCli.containerSecurityContext.runAsGroup Set keycloak-config-cli Security Context runAsGroup

1065

## @param keycloakConfigCli.containerSecurityContext.runAsNonRoot Set keycloak-config-cli Security Context runAsNonRoot

1066

## @param keycloakConfigCli.containerSecurityContext.privileged Set keycloak-config-cli Security Context privileged

1067

## @param keycloakConfigCli.containerSecurityContext.readOnlyRootFilesystem Set keycloak-config-cli Security Context readOnlyRootFilesystem

1068

## @param keycloakConfigCli.containerSecurityContext.allowPrivilegeEscalation Set keycloak-config-cli Security Context allowPrivilegeEscalation

1069

## @param keycloakConfigCli.containerSecurityContext.capabilities.drop List of capabilities to be dropped

1070

## @param keycloakConfigCli.containerSecurityContext.seccompProfile.type Set keycloak-config-cli Security Context seccomp profile

1071

1072

containerSecurityContext:

1073

enabled: true

1074

seLinuxOptions: {}

1075

runAsUser: 1001

1076

runAsGroup: 1001

1077

runAsNonRoot: true

1078

privileged: false

1079

readOnlyRootFilesystem: true

1080

allowPrivilegeEscalation: false

1081

capabilities:

1082

drop: ["ALL"]

1083

seccompProfile:

1084

type: "RuntimeDefault"

1085

## keycloak-config-cli pods' Security Context

1086

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1087

## @param keycloakConfigCli.podSecurityContext.enabled Enabled keycloak-config-cli pods' Security Context

1088

## @param keycloakConfigCli.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

1089

## @param keycloakConfigCli.podSecurityContext.sysctls Set kernel settings using the sysctl interface

1090

## @param keycloakConfigCli.podSecurityContext.supplementalGroups Set filesystem extra groups

1091

## @param keycloakConfigCli.podSecurityContext.fsGroup Set keycloak-config-cli pod's Security Context fsGroup

1092

1093

podSecurityContext:

1094

enabled: true

1095

fsGroupChangePolicy: Always

1096

sysctls: []

1097

supplementalGroups: []

1098

fsGroup: 1001

1099

## @param keycloakConfigCli.backoffLimit Number of retries before considering a Job as failed

1100

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy

1101

1102

backoffLimit: 1

1103

## @param keycloakConfigCli.podLabels Pod extra labels

1104

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1105

1106

podLabels: {}

1107

## @param keycloakConfigCli.podAnnotations Annotations for job pod

1108

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1109

1110

podAnnotations: {}

1111

## @param keycloakConfigCli.nodeSelector Node labels for pod assignment

1112

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1113

1114

nodeSelector: {}

1115

1116

## @param keycloakConfigCli.tolerations Tolerations for job pod assignment

1117

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1118

1119

tolerations: []

1120

## keycloak-config-cli availability-check configuration

1121

## ref: https://github.com/adorsys/keycloak-config-cli#Configuration

1122

## @param keycloakConfigCli.availabilityCheck.enabled Whether to wait until Keycloak is available

1123

## @param keycloakConfigCli.availabilityCheck.timeout Timeout for the availability check (Default is 120s)

1124

1125

availabilityCheck:

1126

enabled: true

1127

timeout: ""

1128

## @param keycloakConfigCli.extraEnvVars Additional environment variables to set

1129

## Example:

1130

## extraEnvVars:

1131

## - name: FOO

1132

## value: "bar"

1133

1134

extraEnvVars: []

1135

## @param keycloakConfigCli.extraEnvVarsCM ConfigMap with extra environment variables

1136

1137

extraEnvVarsCM: ""

1138

## @param keycloakConfigCli.extraEnvVarsSecret Secret with extra environment variables

1139

1140

extraEnvVarsSecret: ""

1141

## @param keycloakConfigCli.extraVolumes Extra volumes to add to the job

1142

1143

extraVolumes: []

1144

## @param keycloakConfigCli.extraVolumeMounts Extra volume mounts to add to the container

1145

1146

extraVolumeMounts: []

1147

## @param keycloakConfigCli.initContainers Add additional init containers to the Keycloak config cli pod

1148

## Example:

1149

## initContainers:

1150

## - name: your-image-name

1151

## image: your-image

1152

## imagePullPolicy: Always

1153

## ports:

1154

## - name: portname

1155

## containerPort: 1234

1156

1157

initContainers: []

1158

## @param keycloakConfigCli.sidecars Add additional sidecar containers to the Keycloak config cli pod

1159

## Example:

1160

## sidecars:

1161

## - name: your-image-name

1162

## image: your-image

1163

## imagePullPolicy: Always

1164

## ports:

1165

## - name: portname

1166

## containerPort: 1234

1167

1168

sidecars: []

1169

## @param keycloakConfigCli.configuration keycloak-config-cli realms configuration

1170

## NOTE: nil keys will be considered files to import locally

1171

## Example:

1172

## configuration:

1173

## realm1.json: |

1174

## {

1175

## "realm": "realm1",

1176

## "clients": []

1177

## }

1178

## realm2.yaml: |

1179

## realm: realm2

1180

## clients: []

1181

1182

configuration: {}

1183

## @param keycloakConfigCli.existingConfigmap ConfigMap with keycloak-config-cli configuration

1184

## NOTE: This will override keycloakConfigCli.configuration

1185

1186

existingConfigmap: ""

1187

## Automatic Cleanup for Finished Jobs

1188

## @param keycloakConfigCli.cleanupAfterFinished.enabled Enables Cleanup for Finished Jobs

1189

## @param keycloakConfigCli.cleanupAfterFinished.seconds Sets the value of ttlSecondsAfterFinished

1190

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/

1191

1192

cleanupAfterFinished:

1193

enabled: false

1194

seconds: 600

1195

## @section Default init container parameters

1196

1197

## Default init Containers

1198

1199

defaultInitContainers:

1200

## 'prepare-write-dirs' init container

1201

## Copies writable directories to an empty dir volume in order to not break the application functionality

1202

1203

prepareWriteDirs:

1204

## @param defaultInitContainers.prepareWriteDirs.enabled Enable init container that copies writable directories to an empty dir

1205

1206

enabled: true

1207

## Configure "prepare-write-dirs" init-container Security Context

1208

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

1209

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.enabled Enabled "prepare-write-dirs" init-containers' Security Context

1210

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in "prepare-write-dirs" init-containers

1211

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.runAsUser Set runAsUser in "prepare-write-dirs" init-containers' Security Context

1212

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.runAsGroup Set runAsGroup in "prepare-write-dirs" init-containers' Security Context

1213

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.runAsNonRoot Set runAsNonRoot in "prepare-write-dirs" init-containers' Security Context

1214

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.privileged Set privileged in "prepare-write-dirs" init-containers' Security Context

1215

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in "prepare-write-dirs" init-containers' Security Context

1216

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in "prepare-write-dirs" init-containers' Security Context

1217

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.capabilities.drop List of capabilities to be dropped in "prepare-write-dirs" init-containers

1218

## @param defaultInitContainers.prepareWriteDirs.containerSecurityContext.seccompProfile.type Set seccomp profile in "prepare-write-dirs" init-containers

1219

1220

containerSecurityContext:

1221

enabled: true

1222

seLinuxOptions: {}

1223

runAsUser: 1001

1224

runAsGroup: 1001

1225

runAsNonRoot: true

1226

privileged: false

1227

readOnlyRootFilesystem: true

1228

allowPrivilegeEscalation: false

1229

capabilities:

1230

drop: ["ALL"]

1231

seccompProfile:

1232

type: "RuntimeDefault"

1233

## Keycloak "prepare-write-dirs" init container resource requests and limits

1234

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1235

## @param defaultInitContainers.prepareWriteDirs.resourcesPreset Set Keycloak "prepare-write-dirs" init container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if defaultInitContainers.prepareWriteDirs.resources is set (defaultInitContainers.prepareWriteDirs.resources is recommended for production).

1236

1237

resourcesPreset: "nano"

1238

## @param defaultInitContainers.prepareWriteDirs.resources Set Keycloak "prepare-write-dirs" init container requests and limits for different resources like CPU or memory (essential for production workloads)

1239

## E.g:

1240

## resources:

1241

## requests:

1242

## cpu: 2

1243

## memory: 512Mi

1244

## limits:

1245

## cpu: 3

1246

## memory: 1024Mi

1247

1248

resources: {}

1249

## @section Database parameters

1250

1251

## PostgreSQL chart configuration

1252

## @param postgresql.enabled Switch to enable or disable the PostgreSQL helm chart

1253

## @param postgresql.auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` with key `postgres-password` is provided

1254

## @param postgresql.auth.username Name for a custom user to create

1255

## @param postgresql.auth.password Password for the custom user to create

1256

## @param postgresql.auth.database Name for a custom database to create

1257

## @param postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials

1258

## @param postgresql.auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set.

1259

## @param postgresql.architecture PostgreSQL architecture (`standalone` or `replication`)

1260

1261

postgresql:

1262

enabled: true

1263

auth:

1264

postgresPassword: ""

1265

username: ig_keycloak

1266

password: ""

1267

database: iamguarded_keycloak

1268

existingSecret: ""

1269

secretKeys:

1270

userPasswordKey: password

1271

architecture: standalone

1272

image:

1273

registry: cgr.dev

1274

repository: chainguard-private/postgres-iamguarded

1275

tag: 18.4-r7

1276

digest: ""

1277

metrics:

1278

image:

1279

registry: cgr.dev

1280

repository: chainguard-private/prometheus-postgres-exporter-iamguarded

1281

tag: 0.20.1

1282

digest: ""

1283

volumePermissions:

1284

image:

1285

registry: cgr.dev

1286

repository: chainguard-private/os-shell-iamguarded

1287

tag: 1.0.0

1288

digest: ""

1289

## External PostgreSQL configuration

1290

## All of these values are only used when postgresql.enabled is set to false

1291

## @param externalDatabase.host Database host

1292

## @param externalDatabase.port Database port number

1293

## @param externalDatabase.user Non-root username for Keycloak

1294

## @param externalDatabase.password Password for the non-root username for Keycloak

1295

## @param externalDatabase.database Keycloak database name

1296

## @param externalDatabase.schema Keycloak database schema

1297

## @param externalDatabase.existingSecret Name of an existing secret resource containing the database credentials

1298

## @param externalDatabase.existingSecretUserKey Name of an existing secret key containing the database user

1299

## @param externalDatabase.existingSecretPasswordKey Name of an existing secret key containing the database credentials

1300

## @param externalDatabase.annotations Additional custom annotations for external database secret object

1301

## @param externalDatabase.extraParams Additional JDBC connection parameters appended to the JDBC URL (KC_DB_URL).

1302

1303

externalDatabase:

1304

host: ""

1305

port: 5432

1306

user: ig_keycloak

1307

database: iamguarded_keycloak

1308

schema: public

1309

password: ""

1310

existingSecret: ""

1311

existingSecretUserKey: ""

1312

existingSecretPasswordKey: ""

1313

annotations: {}

1314

extraParams: ""

1315

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

keycloak

The trusted source for open source

Product

Solutions

Customers

Resources

Company