feat(k8s): keycloak namespace manifests + apply on G14

- new deploy/k8s/keycloak/ kustomization with namespace, keycloak-postgres StatefulSet, keycloak Deployment
- keycloak Deployment uses quay.io/keycloak/keycloak:25.0 with --hostname-strict=false, postgres backend
- PVC data-keycloak-postgres-0 (5Gi local-path) bound to the StatefulSet
- secrets keycloak-postgres / keycloak-admin provisioned in keycloak namespace
- OIDC discovery endpoint confirmed reachable via port-forward; master realm issuer http://.../realms/master
- next round will provision the hwlab realm + OIDC client

deploy/k8s/keycloak/keycloak.yaml

@@ -0,0 +1,90 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: keycloak
+      namespace: keycloak
+      labels:
+        app.kubernetes.io/name: keycloak
+        hwlab.pikastech.local/service-id: keycloak
+    spec:
+      type: ClusterIP
+      selector:
+        app.kubernetes.io/name: keycloak
+      ports:
+        - name: http
+          port: 8080
+          targetPort: http
+  - apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: keycloak
+      namespace: keycloak
+      labels:
+        app.kubernetes.io/name: keycloak
+        hwlab.pikastech.local/service-id: keycloak
+    spec:
+      replicas: 1
+      strategy:
+        type: Recreate
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: keycloak
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: keycloak
+            hwlab.pikastech.local/service-id: keycloak
+        spec:
+          containers:
+            - name: keycloak
+              image: quay.io/keycloak/keycloak:25.0
+              args:
+                - start
+                - --http-enabled=true
+                - --http-port=8080
+                - --hostname-strict=false
+                - --proxy-headers=xforwarded
+                - --features=preview
+                - --db=postgres
+                - --db-url=jdbc:postgresql://keycloak-postgres.keycloak.svc.cluster.local:5432/keycloak
+                - --db-username=keycloak
+                - --health-enabled=true
+              ports:
+                - name: http
+                  containerPort: 8080
+                - name: management
+                  containerPort: 9000
+              env:
+                - name: KC_BOOTSTRAP_ADMIN_USERNAME
+                  value: admin
+                - name: KC_BOOTSTRAP_ADMIN_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: keycloak-admin
+                      key: password
+                - name: KC_DB
+                  value: postgres
+                - name: KC_DB_URL
+                  value: jdbc:postgresql://keycloak-postgres.keycloak.svc.cluster.local:5432/keycloak
+                - name: KC_DB_USERNAME
+                  value: keycloak
+                - name: KC_DB_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: keycloak-postgres
+                      key: password
+              readinessProbe:
+                httpGet:
+                  path: /health/ready
+                  port: 9000
+                initialDelaySeconds: 30
+                periodSeconds: 10
+              livenessProbe:
+                httpGet:
+                  path: /health/live
+                  port: 9000
+                initialDelaySeconds: 60
+                periodSeconds: 30

deploy/k8s/keycloak/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: keycloak
+resources:
+  - namespace.yaml
+  - postgres.yaml
+  - keycloak.yaml
+commonLabels:
+  app.kubernetes.io/part-of: hwlab
+  hwlab.pikastech.local/profile: dev
+  hwlab.pikastech.local/component: identity

deploy/k8s/keycloak/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keycloak
+  labels:
+    app.kubernetes.io/part-of: hwlab
+    hwlab.pikastech.local/profile: dev
+    hwlab.pikastech.local/component: identity

deploy/k8s/keycloak/postgres.yaml

@@ -0,0 +1,82 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: data-keycloak-postgres-0
+      namespace: keycloak
+    spec:
+      accessModes: [ReadWriteOnce]
+      resources:
+        requests:
+          storage: 5Gi
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: keycloak-postgres
+      namespace: keycloak
+      labels:
+        app.kubernetes.io/name: keycloak-postgres
+        hwlab.pikastech.local/service-id: keycloak-postgres
+    spec:
+      type: ClusterIP
+      selector:
+        app.kubernetes.io/name: keycloak-postgres
+      ports:
+        - name: postgres
+          port: 5432
+          targetPort: postgres
+  - apiVersion: apps/v1
+    kind: StatefulSet
+    metadata:
+      name: keycloak-postgres
+      namespace: keycloak
+      labels:
+        app.kubernetes.io/name: keycloak-postgres
+        hwlab.pikastech.local/service-id: keycloak-postgres
+    spec:
+      serviceName: keycloak-postgres
+      replicas: 1
+      selector:
+        matchLabels:
+          app.kubernetes.io/name: keycloak-postgres
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: keycloak-postgres
+            hwlab.pikastech.local/service-id: keycloak-postgres
+        spec:
+          containers:
+            - name: postgres
+              image: postgres:16-alpine
+              ports:
+                - name: postgres
+                  containerPort: 5432
+              env:
+                - name: POSTGRES_DB
+                  value: keycloak
+                - name: POSTGRES_USER
+                  value: keycloak
+                - name: POSTGRES_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: keycloak-postgres
+                      key: password
+              volumeMounts:
+                - name: data
+                  mountPath: /var/lib/postgresql/data
+              readinessProbe:
+                exec:
+                  command: ["pg_isready", "-U", "keycloak"]
+                initialDelaySeconds: 5
+                periodSeconds: 5
+      volumeClaimTemplates:
+        - metadata:
+            name: data
+            namespace: keycloak
+          spec:
+            accessModes: [ReadWriteOnce]
+            resources:
+              requests:
+                storage: 5Gi