# Keycloak Deployment — OpenID Connect identity provider for EDDI
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  labels:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/component: auth
    app.kubernetes.io/part-of: eddi
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/component: auth
  template:
    metadata:
      labels:
        app.kubernetes.io/name: keycloak
        app.kubernetes.io/component: auth
        app.kubernetes.io/part-of: eddi
    spec:
      containers:
        - name: keycloak
          image: quay.io/keycloak/keycloak:26.0
          args: ["start-dev"]
          ports:
            - containerPort: 8080
              name: http
          env:
            - name: KC_BOOTSTRAP_ADMIN_USERNAME
              value: "admin"
            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
              value: "admin"
            - name: KC_HTTP_PORT
              value: "8080"
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 1Gi
          readinessProbe:
            httpGet:
              path: /health/ready
              port: http
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            httpGet:
              path: /health/live
              port: http
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 5
---
# Keycloak Service
apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/component: auth
    app.kubernetes.io/part-of: eddi
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/component: auth
  ports:
    - name: http
      port: 8080
      targetPort: http
