apiVersion: v1
kind: ConfigMap
metadata:
  name: kcshim
  namespace: keycloak
data:
  default.conf: |
    server {
      listen 80;
      location = /realms/spinoza/.well-known/openid-configuration {
        default_type application/json;
        alias /etc/kcshim/discovery.json;
      }
      location / {
        proxy_pass http://keycloak.keycloak.svc.cluster.local:8080;
        proxy_set_header Host $host;
      }
    }
  discovery.json: |
    {
      "issuer": "https://keycloak.localtest.me:8443/realms/spinoza",
      "authorization_endpoint": "http://kcshim.keycloak.svc.cluster.local/realms/spinoza/protocol/openid-connect/auth",
      "token_endpoint": "http://keycloak.keycloak.svc.cluster.local:8080/realms/spinoza/protocol/openid-connect/token",
      "userinfo_endpoint": "http://keycloak.keycloak.svc.cluster.local:8080/realms/spinoza/protocol/openid-connect/userinfo",
      "jwks_uri": "http://keycloak.keycloak.svc.cluster.local:8080/realms/spinoza/protocol/openid-connect/certs",
      "end_session_endpoint": "http://kcshim.keycloak.svc.cluster.local/realms/spinoza/protocol/openid-connect/logout",
      "id_token_signing_alg_values_supported": ["RS256"],
      "scopes_supported": ["openid", "profile", "email"],
      "response_types_supported": ["code"],
      "subject_types_supported": ["public"]
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kcshim
  namespace: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kcshim
  template:
    metadata:
      labels:
        app: kcshim
    spec:
      containers:
        - name: nginx
          image: nginx:1.29-alpine
          ports:
            - name: http
              containerPort: 80
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
            - name: conf
              mountPath: /etc/kcshim/discovery.json
              subPath: discovery.json
      volumes:
        - name: conf
          configMap:
            name: kcshim
---
apiVersion: v1
kind: Service
metadata:
  name: kcshim
  namespace: keycloak
spec:
  selector:
    app: kcshim
  ports:
    - name: http
      port: 80
      targetPort: http