{{- $settings := fromYaml (include "keycloak.settings" .) }}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-service
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  ports:
    # The serving port. Both Ingresses target it BY NAME ("http"), and
    # in-cluster consumers reach it at
    #   http://<release>-keycloak-service.<namespace>.svc.cluster.local:8080
    - protocol: TCP
      port: {{ $settings.ports.http | int64 }}
      targetPort: http
      name: http
  # DELIBERATELY NO MANAGEMENT PORT AND NO JGROUPS PORT HERE. The management
  # port has a Service of its own (keycloak.management.service.yaml) so that
  # whatever scrapes it has to name it explicitly rather than inherit it from
  # the Service an Ingress points at - mixing the two is how an
  # unauthenticated health endpoint ends up one annotation away from the
  # internet. JGroups needs no Service at all: jdbc-ping discovers peers
  # through the database and the nodes then talk pod IP to pod IP.
  #
  # ClusterIP, and no value to change it. The way out of the cluster is the
  # Ingress with a certificate, not a NodePort that puts an identity provider
  # on a routable address by accident.
  type: ClusterIP