本文主要讲解基于kubernetes部署keycloak,并通过ingress暴露服务
首先为 ingress 准备tls证书,有关证书生成,请参考 Keycloak 高可用部署实战 生成证书部分,这里就步骤重复描述。
证书生成以后,创建 tls secret
kubectl create secret tls keycloak-tls --key server.key --cert server.crt
然后编辑kubernetes 资源文件 keycloak.yaml
apiVersion: v1
kind: Service
metadata:
name: keycloak
labels:
app: keycloak
spec:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
app: keycloak
type: ClusterIP
clusterIP: None # keycloak 分布式缓存需要依赖 headless service
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: keycloak
labels:
app: keycloak
spec:
replicas: 1
selector:
matchLabels:
app: keycloak
template:
metadata:
labels:
app: keycloak
spec:
containers:
- name: keycloak
image: quay.io/keycloak/keycloak:20.0.3
args: ["start"]
env:
- name: KEYCLOAK_ADMIN
value: "admin"
- name: KEYCLOAK_ADMIN_PASSWORD
value: "admin"
- name: KC_DB
value: "mysql"
- name: KC_DB_URL
value: "jdbc:mysql://192.168.21.138:3306/keycloak?characterEncoding=UTF-8"
- name: KC_DB_USERNAME
value: "keycloak"
- name: KC_DB_PASSWORD
value: "keycloak"
- name: KC_PROXY
value: "edge"
- name: KC_HTTP_ENABLED
value: "true"
- name: KC_HOSTNAME_URL
value: "https://keycloak.example.io"
- name: KC_HOSTNAME_ADMIN_URL
value: "https://keycloak.example.io"
- name: KC_CACHE_STACK
value: "kubernetes"
- name: JAVA_OPTS_APPEND
value: "-Djgroups.dns.query=keycloak.default.svc.cluster.local"
ports:
- name: http
containerPort: 8080
readinessProbe:
httpGet:
path: /realms/master
port: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: keycloak
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
spec:
ingressClassName: nginx
tls:
- hosts:
- keycloak.example.io
secretName: keycloak-tls
rules:
- host: keycloak.example.io
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: keycloak
port:
number: 8080
部署keycloak,部署完成以后即可通过ingress访问keycloak
kubectl apply -f keycloak.yaml