第19章：Keycloak IAM Kubernetes 生产环境部署 — Helm、Operator 与高可用 | IDaaS Book

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: production-keycloak
  namespace: keycloak
  labels:
    app: keycloak
spec:
  instances: 3
  image: quay.io/keycloak/keycloak:26.7.0   # 示例版本；上线前复核当前稳定版
  hostname:
    hostname: auth.example.com
  http:
    httpEnabled: true        # Ingress/LB 终结 TLS 后以明文转发到 Keycloak
  ingress:
    enabled: false  # 使用独立的 Ingress 配置（在 Ingress 层终结 TLS）
  db:
    vendor: postgres
    host: postgres-postgresql.keycloak-db.svc.cluster.local
    port: 5432
    database: keycloak
    usernameSecret:
      name: keycloak-db-secret
      key: username
    passwordSecret:
      name: keycloak-db-secret
      key: password
  proxy:
    headers: xforwarded  # 信任外部 Ingress/LB 转发的 X-Forwarded-* 头
  cache:
    configMapFile:
      name: keycloak-cache-config
      key: cache-ispn.xml
  features:
    enabled:
      - authorization
      - token-exchange
      - admin-fine-grained-authz
  additionalOptions:
    - name: log-level
      value: INFO
    - name: metrics-enabled
      value: "true"
    - name: health-enabled
      value: "true"   # 启用 /health/* 端点（见 19.5 健康检查）

# 使用 Bitnami PostgreSQL HA 或 Cloud SQL
apiVersion: apps/v1
kind: Secret
metadata:
  name: keycloak-db-secret
  namespace: keycloak
stringData:
  username: keycloak
  password: <strong-random-password>

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
    - labelSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - keycloak
      topologyKey: kubernetes.io/hostname

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: keycloak-pdb
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app: keycloak

livenessProbe:
  httpGet:
    path: /health/live
    port: 9000
  initialDelaySeconds: 30
  periodSeconds: 10
readinessProbe:
  httpGet:
    path: /health/ready
    port: 9000
  initialDelaySeconds: 10
  periodSeconds: 5

additionalOptions:
  - name: db-pool-initial-size
    value: "10"
  - name: db-pool-min-size
    value: "10"
  - name: db-pool-max-size
    value: "40"

apiVersion: batch/v1
kind: CronJob
metadata:
  name: keycloak-db-backup
spec:
  schedule: "0 1 * * *"
  jobTemplate:
    spec:
      containers:
      - name: backup
        image: postgres:16
        env:
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              name: keycloak-db-secret
              key: password
        command:
        - /bin/sh
        - -c
        - |
          pg_dump -h postgres-host -U keycloak -d keycloak \
            | gzip > /backup/keycloak-$(date +%Y%m%d).sql.gz
        volumeMounts:
        - name: backup
          mountPath: /backup
      volumes:
      - name: backup
        persistentVolumeClaim:
          claimName: backup-pvc

groups:
- name: keycloak
  rules:
  - alert: KeycloakHighAuthLatency
    expr: rate(keycloak_request_duration_seconds_sum[5m]) / rate(keycloak_request_duration_seconds_count[5m]) > 2
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "Keycloak 认证延迟超过 2 秒"
  
  - alert: KeycloakHighLoginFailureRate
    expr: rate(keycloak_failed_login_attempts_total[5m]) > 10
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "登录失败率异常升高"
  
  - alert: KeycloakDown
    expr: up{job="keycloak"} == 0
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "Keycloak 实例不可用"

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: keycloak-network-policy
spec:
  podSelector:
    matchLabels:
      app: keycloak
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - port: 8443
      protocol: TCP
    - port: 9000  # management
      protocol: TCP
  egress:
  - to:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: postgresql
    ports:
    - port: 5432

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: keycloak-db-credentials
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: keycloak-db-secret
  data:
  - secretKey: username
    remoteRef:
      key: secret/data/keycloak/db
      property: username
  - secretKey: password
    remoteRef:
      key: secret/data/keycloak/db
      property: password

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: keycloak-tls
  namespace: keycloak
spec:
  secretName: keycloak-tls-secret
  dnsNames:
    - auth.example.com
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer