Merge pull request #396 from gambol99/kube_deployment

Kube Deployment Example

kube/reverse.yml

@@ -11,23 +11,44 @@ spec:
       annotations:
         repository: https://github.com/gambol99/keycloak-proxy
     spec:
+      securityContext:
+        fsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+      volumes:
+      - name: certs
+        secret:
+          secretName: tls
       containers:
         - name: proxy
           image: quay.io/gambol99/keycloak-proxy:latest
           imagePullPolicy: Always
           args:
-          - --config=/etc/secrets/config.yml
-          - --discovery-url=https://sso.example.com/auth/realms/hod-test
             - --client-id=broker
-          - --client-secret=secret
-          - --listen=127.0.0.1:3000
-          - --enable-logging=true
+            - --discovery-url=https://sso.example.com/auth/realms/hod-test
+            - --enable-default-deny=false
             - --enable-json-logging=true
+            - --enable-logging=true
+            - --enable-request-id=true
+            - --enable-security-filter=true
+            - --http-only-cookie=true
+            - --listen=127.0.0.1:3000
+            - --preserve-host=true
+            - --redirection-url=https://www.example.com
+            - --resources=uri=/admin/*|roles=admin
+            - --skip-client-id=true
+            - --tls-cert=/certs/tls.pem
+            - --tls-private-key=/certs/tls-key.pem
             - --upstream-url=http://127.0.0.1:8080
+          env:
+            - name: PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: openid
+                  key: client.secret
+          securityContext:
+            readOnlyRootFilesystem: true
           volumeMounts:
-        - name: secrets
-          mountPath: /etc/secrets
-      volumes:
-      - name: secrets
-        secret:
-          secretName: config
+          - name: certs
+            mountPath: /certs
+            readOnly: true