{{- $settings := fromYaml (include "keycloak.settings" .) }}
{{- /*
THE MANAGEMENT SERVICE, AND WHAT IT IS AND IS NOT FOR.

Keycloak serves /health, /health/live, /health/ready, /health/started and -
with keycloak.metrics.enabled - /metrics on the management port, and it serves
them WITHOUT AUTHENTICATION. The probes do not need this Service (the kubelet
addresses the container port directly); a metrics scraper or an uptime check
inside the cluster does, which is the only reason it exists.

IT IS A SEPARATE OBJECT FROM THE SERVING SERVICE ON PURPOSE. Putting port 9000
next to port 8080 on one Service would mean the Service an Ingress already
points at also carries the unauthenticated health and metrics surface - and
then publishing it is one wrong port name in an Ingress backend away, with
nothing in the diff that reads as a mistake. Separated, naming it is a
deliberate act.

AND IT MUST NEVER GET AN INGRESS. There is no value in this chart that would
publish it, and none should be added. An unauthenticated readiness endpoint on
the internet tells an attacker when the database is down; /metrics tells them
the realm and client names. Upstream's own alternative for this - setting
legacy-observability-interface=true, which moves health back onto the serving
port where the Ingress already is - is explicitly "not recommended for security
reasons", and this chart does not offer it.
*/ -}}
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-management-service
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  selector:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  ports:
    - protocol: TCP
      port: {{ $settings.ports.management | int64 }}
      targetPort: management
      name: management
  type: ClusterIP