values.yaml

# Default values for keycloak-operator.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

operator:
  # -- Enable deploying the keycloak-operator
  enabled: true

  # -- Number or oeprator pods to start.
  replicaCount: 1

  image:
    # -- Operator Image source.
    repository: quay.io/keycloak/keycloak-operator
    # -- Pull policy for Operator.
    pullPolicy: IfNotPresent
    # Overrides the image tag whose default is the chart appVersion.
    tag: ""

  config:
    keycloakImage:
      # -- Default keycloak image to use if non was specified in the Keycloak CRD.
      repository: quay.io/keycloak/keycloak
      # Overrides the keycloak image tag whose default is the chart appVersion.
      tag: ""

  serviceAccount:
    # -- Specifies whether a service account should be created.
    create: true
    # -- Annotations to add to the service account
    annotations: {}
    # -- The name of the service account to use.
    # If not set and create is true, a name is generated using the fullname template
    name: ""

  # -- Annotations to set on the Operator Deployment.
  deploymentAnnotations: {}

  # -- Annotations to set on the Operator Pod.
  podAnnotations: {}

  # -- Pod security group configuration for Operator Deployment.
  podSecurityContext: {}
    # fsGroup: 2000

  # -- Security context for Operator Deployment.
  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  service:
    # -- Enable creation of Service
    enabled: true
    # -- Service type for Operator.
    type: ClusterIP
    # -- Service port for Operator.
    port: 8080

  # -- Resource requests and limits for Operator Deployment.
  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  # -- Node selector for Operator Deployment.
  nodeSelector: {}

  # -- Pod Topology Spread Constraints for Operator Deployment
  podTopologySpreadConstraints: {}

  # -- Tolerations for Operator Deployment.
  tolerations: []

  # -- Affinity for Operator Deployment.
  affinity: {}

keycloak:
  # -- Enable deploying a bundled keycloak with the operator
  enabled: false

  # -- Configuration of the Keycloak server expressed as a keys and values that can be either direct values or references to secrets.
  additionalOptions: ~
  # - name: string
  #   value: string
  #   secret:
  #     optional: bool
  #     key: string
  #     name: string

  # -- Configure keycloaks cache.
  cache: {}
  #  configMapFile:
  #    key: string
  #    name: string
  #    optional: bool

  db:
    # -- Sets the database name of the default JDBC URL of the chosen vendor. If the `url` option is set, this option is ignored.
    database: ~

    # -- Sets the hostname of the default JDBC URL of the chosen vendor. If the `url` option is set, this option is ignored.
    host: ~

    # -- The reference to a secret holding the password of the database user.
    passwordSecret: ~
    # optional: bool
    # key: string
    # name: string

    # -- The initial size of the connection pool.
    poolInitialSize: ~

    # -- The maximum size of the connection pool.
    poolMaxSize: ~

    # -- The minimal size of the connection pool.
    poolMinSize: ~

    # -- Sets the port of the default JDBC URL of the chosen vendor. If the `url` option is set, this option is ignored.
    port: ~

    # -- The database schema to be used.
    schema: ~

    # -- The full database JDBC URL. If not provided, a default URL is set based on the selected database vendor.
    url:

    # -- The reference to a secret holding the username of the database user.
    usernameSecret: ~
    # optional: bool
    # key: string
    # name: string

    # -- The database vendor.
    vendor: ~

  # -- Configure Keycloak features
  # @default -- see [Keycloak docs](https://www.keycloak.org/server/features)
  features:

    # -- Disabled Keycloak features
    disabled: []

    # -- Enabled Keycloak features
    enabled: []

  hostname:
    # -- The hostname for accessing the administration console.
    admin: ~

    # -- Set the base URL for accessing the administration console.
    adminUrl: ~

    # -- (bool) Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path. Set to true if your application accesses Keycloak via a private network.
    # @default -- Use the operator's default if not set.
    backchannelDynamic: ~

    # -- Hostname for the Keycloak server.
    # @default -- Disabled if not set.
    hostname: ~

    # -- Disables dynamically resolving the hostname from request headers
    strict: false

  http:
    # -- Enable a HTTP listener
    httpEnabled: true

    # -- The used HTTP port
    httpPort: ~

    # -- The used HTTPS port
    httpsPort: ~

    # -- A secret containing the TLS configuration for HTTPS.
    tlsSecret: ~

  httpManagement:
    # -- Port of management interface.
    port: ~

  image:
    # -- Overrides the operator.keycloakImage.image value whose default is quay.io/keycloak/keycloak
    repository: ""

    # -- Overrides the operator.keycloakImage.tag value whose default is the chart appVersion.
    tag: ""

  # -- Secret(s) that might be used when pulling an image from a private container image registry or repository.
  imagePullSecrets: ~
  # - name: secret-name

  ingress:
    # -- The deployment is, by default, exposed through a basic ingress.
    enabled: true

    # -- Annotations for the Ingress
    annotations: []

    # -- Ingress class name
    className: ""

  # -- Number of Keycloak instances in HA mode.
  instances: 1

  proxy:
    # -- The proxy headers that should be accepted by the server. Misconfiguration might leave the server exposed to security vulnerabilities.
    headers: ""

  # -- Compute Resources required by Keycloak container
  resources: {}
  #  claims:
  #    - name: string
  #  limits: {}
  #  requests: {}

  # -- Set to force the behavior of the --optimized flag for the start command. If left unspecified the operator will assume custom images have already been augmented.
  startOptimized: ~

  transaction:
    # -- Determine whether Keycloak should use a non-XA datasource.
    xaEnabled: false

  truststores:
    # -- Configure Keycloak truststores via Secrets.
    secret: {}

  # -- Additional values that will be merged with the operator's defaults
  unsupported:
  #  podTemplate: ~
  #    metadata:
  #      labels:
  #        foo: "bar"
  #    spec:
  #      containers:
  #        - volumeMounts:
  #            - name: test-volume
  #              mountPath: /mnt/test
  #          command: [ "/bin/bash", "-c", "cat /mnt/test/test.txt && /opt/keycloak/bin/kc.sh start-dev" ]
  #      volumes:
  #        - name: test-volume
  #          secret:
  #            secretName: keycloak-podtemplate-secret

  realmimport:
    # -- Deploy realmimport resources
    enabled: false
    # -- A list of realms to configure using the realmimport CRD.
    realms: []
    # - keycloakCRName: string
    #   accessCodeLifespan: integer
    #   accessCodeLifespanLogin: integer
    #   accessCodeLifespanUserAction: integer
    #   accessTokenLifespan: integer
    #   accessTokenLifespanForImplicitFlow: integer
    #   accountTheme: string
    #   actionTokenGeneratedByAdminLifespan: integer
    #   actionTokenGeneratedByUserLifespan: integer
    #   adminEventsDetailsEnabled: boolean
    #   adminEventsEnabled: boolean
    #   adminTheme: string
    #   applicationScopeMappings: []
    #   applications: []
    #   attributes: {}
    #   authenticationFlows: []
    #   authenticatorConfig: {}
    #   browserFlow: string
    #   browserSecurityHeaders: {}
    #   bruteForceProtected: boolean
    #   clientAuthenticationFlow: string
    #   clientOfflineSessionIdleTimeout: integer
    #   clientOfflineSessionMaxLifespan: integer
    #   clientPolicies: {}
    #   clientProfiles: {}
    #   clientScopeMappings: []
    #   clientScopes: []
    #   clientSessionIdleTimeout: integer
    #   clientSessionMaxLifespan: integer
    #   clientTemplates: []
    #   clients: []
    #   codeSecret: string
    #   defaultDefaultClientScopes: []
    #   defaultGroups: {}
    #   defaultLocale: string
    #   defaultOptionalClientScopes: []
    #   defaultRole: {}
    #   defaultRoles: []
    #   defaultSignatureAlgorithm: string
    #   directGrantFlow: string
    #   displayName: string
    #   displayNameHtml: string
    #   dockerAuthenticationFlow: string
    #   duplicateEmailsAllowed: boolean
    #   editUsernameAllowed: boolean
    #   emailTheme: string
    #   enabled: boolean
    #   enabledEventTypes: []
    #   eventsEnabled: boolean
    #   eventsListeners: []
    #   failureFactor: integer
    #   federatedUsers: []
    #   firstBrokerLoginFlow: string
    #   groups: []
    #   id: string
    #   identityProviderMappers: []
    #   identityProviders: []
    #   internationalizationEnabled: bool
    #   keycloakVersion: string
    #   localizationTexts: []
    #   loginTheme: string
    #   loginWithEmailAllowed: boolean
    #   maxDeltaTimeSeconds: integer
    #   maxFailureWaitSeconds: integer
    #   maxTEmporaryLockouts: integer
    #   minimumQuickLoginWaitSeconds: integer
    #   notBefore: integer
    #   oauth2DeviceCodeLifespan: integer
    #   oauth2DevicePollingInterval: integer
    #   oauthClients: []
    #   offlineSessionIdleTimeout: integer
    #   offlineSessionMaxLifespan: integer
    #   offlineSessionMaxLifespanEnabled: boolean
    #   organizations: []
    #   organizationsEnabled: boolean
    #   otpPolicyAlgorithm: string
    #   otpPolicyCodeReusable: boolean
    #   otpPolicyDigits: integer
    #   otpPolicyInitialCounter: integer
    #   otpPolicyLookAheadWindow: integer
    #   otpPolicyPeriod: integer
    #   otpPolicyType: string
    #   otpSupportedApplications: []
    #   passwordCredentialGrantAllowed: boolean
    #   passwordPolicy: string
    #   permanentLockout: boolean
    #   privateKey: string
    #   protocolMappers: []
    #   publicKey: string
    #   quickLoginCheckMilliSeconds: integer
    #   realmCacheEnabled: boolean
    #   realm: string
    #   refreshTokenMaxReuse: integer
    #   registrationAllowed: boolean
    #   registrationEmailAsUsername: boolean
    #   registrationFlow: string
    #   rememberMe: boolean
    #   requiredActions: []
    #   requiredCredentials: []
    #   resetCredentialsFlow: string
    #   resetPasswordAllowed: boolean
    #   revokeRefreshToken: boolean
    #   roles: []
    #   scopeMappings: []
    #   smtpServer: {}
    #   social: boolean
    #   socialProviders: {}
    #   sslRequired: boolean
    #   ssoSessionIdleTimeout: integer
    #   ssoSessionIdleTimeoutRememberMe: integer
    #   ssoSessionMaxLifespan: integer
    #   ssoSessionMaxLifespanRememberMe: integer
    #   supportedLocales: []
    #   updateProfileOnInitialSocialLogin: boolean
    #   userCacheEnabled: boolean
    #   userFederationMappers: []
    #   userFederationProviders: []
    #   userManagedAccessAllowed: boolean
    #   users: []
    #   verifyEmail: boolean
    #   waitIncrementSeconds: boolean
    #   webAuthnPolicyAcceptableAaguids: []
    #   webAuthnPolicyAttestationConveyancePreference: string
    #   webAuthnPolicyAvoidSameAuthenticatorRegister: boolean
    #   webAuthnPolicyAuthenticatorAttachment: string
    #   webAuthnPolicyCreateTimeout: integer
    #   webAuthnPolicyExtraOrigins: []
    #   webAuthnPolicyPasswordlessAcceptableAaguids: []
    #   webAuthnPolicyPasswordlessAttestationConveyancePreference: string
    #   webAuthnPolicyPasswordlessAuthenticatorAttachement: string
    #   webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister: boolean
    #   webAuthnPolicyPasswordlessCreateTimeout: integer
    #   webAuthnPolicyPasswordlessExtraOrigins: []
    #   webAuthnPolicyPasswordlessRequireResidentKey: boolean
    #   webAuthnPolicyPasswordlessRpEntityName: string
    #   webAuthnPolicyPasswordlessRpId: string
    #   webAuthnPolicyPasswordlessSignatureAlgorithms: []
    #   webAuthnPolicyPasswordlessUserVerificationRequirement: string
    #   webAuthnPolicyRequireResidentKey: boolean
    #   webAuthnPolicyRpEntityName: string
    #   webAuthnPolicyRpId: string
    #   webAuthnPolicySignatureAlgorithms: []
    #   webAuthnPolicyUserVerificationRequirement: string