基于kubernetes 部署 keycloak

本文主要讲解基于kubernetes部署keycloak，并通过ingress暴露服务

首先为 ingress 准备tls证书，有关证书生成，请参考 Keycloak 高可用部署实战 生成证书部分，这里就步骤重复描述。

证书生成以后，创建 tls secret

kubectl create secret tls keycloak-tls --key server.key --cert server.crt

然后编辑kubernetes 资源文件 keycloak.yaml

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  ports:
    - name: http
      port: 8080
      targetPort: 8080
  selector:
    app: keycloak
  type: ClusterIP
  clusterIP: None     # keycloak 分布式缓存需要依赖 headless service
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
        - name: keycloak
          image: quay.io/keycloak/keycloak:20.0.3
          args: ["start"]
          env:
            - name: KEYCLOAK_ADMIN
              value: "admin"
            - name: KEYCLOAK_ADMIN_PASSWORD
              value: "admin"
            - name: KC_DB
              value: "mysql"
            - name: KC_DB_URL
              value: "jdbc:mysql://192.168.21.138:3306/keycloak?characterEncoding=UTF-8"
            - name: KC_DB_USERNAME
              value: "keycloak"
            - name: KC_DB_PASSWORD
              value: "keycloak"
            - name: KC_PROXY
              value: "edge"
            - name: KC_HTTP_ENABLED
              value: "true"
            - name: KC_HOSTNAME_URL
              value: "https://keycloak.example.io"
            - name: KC_HOSTNAME_ADMIN_URL
              value: "https://keycloak.example.io"
            - name: KC_CACHE_STACK
              value: "kubernetes"
            - name: JAVA_OPTS_APPEND
              value: "-Djgroups.dns.query=keycloak.default.svc.cluster.local"
          ports:
            - name: http
              containerPort: 8080
          readinessProbe:
            httpGet:
              path: /realms/master
              port: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - keycloak.example.io
      secretName: keycloak-tls
  rules:
    - host: keycloak.example.io
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: keycloak
                port:
                  number: 8080

部署keycloak，部署完成以后即可通过ingress访问keycloak

kubectl apply -f keycloak.yaml