# Fixtures for the keycloak install-test: a throwaway PostgreSQL plus the two
# Secrets the 1Password operator would otherwise materialize from the
# OnePasswordItems the chart renders (release name: ci, stub CRD in ci/common/).
#
# WHY A REAL DATABASE AND NOT A STUB: Keycloak does nothing without one. It
# creates its entire schema through Liquibase on first start, and - the reason
# this fixture is the valuable half of the test - jdbc-ping discovers the second
# replica THROUGH this database. A stub would turn a cluster test into a
# templating test.
#
# The image is pinned to a major line like every other fixture here
# (postgres:16-alpine); ci/** is excluded from Renovate on purpose, because
# this is test scaffolding and churning it only risks breaking the
# install-test.
apiVersion: v1
kind: Secret
metadata:
  name: ci-keycloak-db-secret
stringData:
  # The field NAMES are what matters here, not the values: the operator
  # materializes one Secret key per item field, and the Deployment references
  # these two by name. A rename on either side leaves the pod in
  # CreateContainerConfigError, which is a state no render can show.
  #
  # They must agree with the POSTGRES_USER / POSTGRES_PASSWORD below, because
  # Keycloak really connects.
  username: keycloak
  password: ci-keycloak-db-password
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-keycloak-bootstrap-admin-secret
stringData:
  # The temporary bootstrap administrator. Keycloak creates it while the master
  # realm is created, so these values are exercised on the very first start -
  # and the variables are named KC_BOOTSTRAP_ADMIN_* only since Keycloak 26.
  #
  # A visibly throwaway password: nothing here survives the run, the cluster is
  # deleted with the job, and the only thing it protects is a realm that exists
  # for a few minutes.
  username: ci-temp-admin
  password: ci-bootstrap-admin-password
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: public.ecr.aws/docker/library/postgres:16-alpine
          env:
            - name: POSTGRES_USER
              value: keycloak
            - name: POSTGRES_PASSWORD
              value: ci-keycloak-db-password
            - name: POSTGRES_DB
              value: keycloak
          ports:
            - containerPort: 5432
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "keycloak"]
            periodSeconds: 5
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
      volumes:
        # emptyDir: the database exists for the length of one job. Nothing here
        # is meant to survive, and a PVC would only add a provisioner to the
        # list of things that can fail a chart's test.
        - name: data
          emptyDir: {}
---
apiVersion: v1
kind: ConfigMap
metadata:
  # A MINIMAL BUT REAL LOGIN THEME, so that the install-test actually walks the
  # path keycloak.extraVolumes exists for (Gitea #88) instead of only rendering
  # it. ci/keycloak/test-values.yaml mounts it on the SUBPATH
  # /opt/keycloak/themes/ci-theme - never on /opt/keycloak/themes itself, which
  # would hide the image's base, keycloak and keycloak.v2 themes.
  name: ci-keycloak-theme
data:
  # A theme's layout is <theme>/<type>/theme.properties, and a ConfigMap key
  # cannot contain a slash - so the "login/" directory is produced by
  # items[].path in the volume, which can. That indirection is exactly the part
  # of the theme route a render cannot verify and a running pod can.
  theme.properties: |
    parent=keycloak.v2
    # The reason the issue was opened: Keycloak has no logo field on an identity
    # provider, so the icon on its login button comes only from a login theme.
    # Nothing in CI drives a browser, so this line is carried rather than
    # checked - what the run proves is that the theme reaches the container.
    kcLogoIdP-ci-provider = fa fa-lock
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432