Keycloak sidecar

keycloak.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  creationTimestamp: null
  name: httpbin-proxy
data:
  proxy.json: |-
    {
        "target-url": "http://localhost:8000",
        "send-access-token": true,
        "bind-address": "0.0.0.0",
        "http-port": "8080",
        "applications": [
            {
                "base-path": "/",
                "adapter-config": {
                  "realm": "httpbin",
                  "auth-server-url": "https://[keycloak-server-url]/auth",
                  "ssl-required": "external",
                  "resource": "httpbin",
                  "credentials": {
                    "secret": "d97cfa70-8eb1-443a-8320-4cde9da34de6"
                  }
                }
          ,
          "constraints": [
                    {
                        "pattern": "/*",
                        "roles-allowed": [
                            "httpbin-role"
                        ]
                    }
                ]
            }
        ]
    }
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      containers:
      - image: citizenstig/httpbin
        imagePullPolicy: IfNotPresent
        name: httpd
        ports:
        - containerPort: 8000
          name: http-httpbin
      - image: jboss/keycloak-proxy:3.4.2.Final
        name: httpbin-proxy
        volumeMounts:
        - mountPath: /opt/jboss/conf
          name: config
        ports:
        - containerPort: 8080
          name: http-proxy
      volumes:
      - name: config
        configMap:
          name: httpbin-proxy
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    version: v1
spec:
  ports:
    - name: http-httpbin
      port: 8000
    - name: http-proxy
      port: 8080
  selector:
    app: httpbin
    version: v1
---
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: keycloak-server
  labels:
    app: keycloak-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak-server
  template:
    metadata:
      labels:
        app: keycloak-server
        version: "3.4.2"
    spec:
      containers:
      - image: jboss/keycloak:3.4.2.Final
        name: keycloak
        ports:
        - containerPort: 8080
          name: http
        env:
        - name: KEYCLOAK_USER
          value: "root"
        - name: KEYCLOAK_PASSWORD
          value: "PassW0rd"       
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"   
---
apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak-server
    version: "3.4.2"
spec:
  ports:
    - name: http
      port: 8080
  selector:
    app: keycloak-server
    version: "3.4.2"