Appendix C. Service and StatefulSet YAML configuration for Red Hat build of Keycloak The Service and StatefulSet YAML resource configuration used when configuring Red Hat's build of Keycloak (RHBK) for Red Hat's Trusted Artifact Signer (RHTAS) service. --- apiVersion: v1 kind: Service metadata: name: postgresql-db namespace: keycloak-system spec: internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - port: 5432 selector: app: postgresql-db --- apiVersion: apps/v1 kind: StatefulSet metadata: name: postgresql-db namespace: keycloak-system spec: persistentVolumeClaimRetentionPolicy: whenDeleted: Retain whenScaled: Retain podManagementPolicy: OrderedReady replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: postgresql-db serviceName: postgresql-db template: metadata: labels: app: postgresql-db spec: containers: - env: - name: POSTGRESQL_USER valueFrom: secretKeyRef: key: username name: postgresql-db - name: POSTGRESQL_PASSWORD valueFrom: secretKeyRef: key: password name: postgresql-db - name: POSTGRESQL_DATABASE valueFrom: secretKeyRef: key: database name: postgresql-db image: registry.redhat.io/rhel9/postgresql-15:latest imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /usr/libexec/check-container - --live failureThreshold: 3 initialDelaySeconds: 120 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 name: postgresql-db readinessProbe: exec: command: - /usr/libexec/check-container failureThreshold: 3 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/lib/pgsql/data name: data dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 updateStrategy: rollingUpdate: partition: 0 type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: data spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi volumeMode: Filesystem Return to configuring RHBK procedure .

Commands:
--- apiVersion: v1 kind: Service metadata: name: postgresql-db namespace: keycloak-system spec: internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - port: 5432 selector: app: postgresql-db --- apiVersion: apps/v1 kind: StatefulSet metadata: name: postgresql-db namespace: keycloak-system spec: persistentVolumeClaimRetentionPolicy: whenDeleted: Retain whenScaled: Retain podManagementPolicy: OrderedReady replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: postgresql-db serviceName: postgresql-db template: metadata: labels: app: postgresql-db spec: containers: - env: - name: POSTGRESQL_USER valueFrom: secretKeyRef: key: username name: postgresql-db - name: POSTGRESQL_PASSWORD valueFrom: secretKeyRef: key: password name: postgresql-db - name: POSTGRESQL_DATABASE valueFrom: secretKeyRef: key: database name: postgresql-db image: registry.redhat.io/rhel9/postgresql-15:latest imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /usr/libexec/check-container - --live failureThreshold: 3 initialDelaySeconds: 120 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 name: postgresql-db readinessProbe: exec: command: - /usr/libexec/check-container failureThreshold: 3 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/lib/pgsql/data name: data dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 updateStrategy: rollingUpdate: partition: 0 type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: data spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi volumeMode: Filesystem