# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0

file:
  /opt/bitnami/keycloak/conf/keycloak.conf:
    exists: true
    filetype: file
    mode: "0644"
command:
  check-logging-config:
    exec: $(echo $KC_LOG_CONSOLE_OUTPUT | grep -q {{ .Vars.logging.output }})
    exit-status: 0
  {{ if .Vars.tls.enabled }}
  check-https-port-config:
    exec: $(echo $KC_HTTPS_PORT | grep -q {{ .Vars.containerPorts.https }})
    exit-status: 0
  {{ if .Vars.tls.autoGenerated.enabled }}
  check-https-certs-config:
    exec: $(echo $KC_HTTPS_CERTIFICATE_FILE | grep -q /opt/bitnami/keycloak/certs/tls.crt && echo $KC_HTTPS_CERTIFICATE_KEY_FILE | grep -q /opt/bitnami/keycloak/certs/tls.key)
    exit-status: 0
  {{ end }}
  {{ end }}
  {{ if .Vars.metrics.enabled }}
  check-management-port-config:
    exec: $(echo $KC_HTTP_MANAGEMENT_PORT | grep -q {{ .Vars.containerPorts.management }})
    exit-status: 0
  check-metrics-config:
    exec: $(echo $KC_METRICS_ENABLED | grep -q true)
    exit-status: 0
  {{ end }}
  {{ if and .Vars.serviceAccount.create .Vars.automountServiceAccountToken }}
  check-sa:
    exec: cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -d '.' -f 2 | xargs -I '{}' echo '{}====' | fold -w 4 | sed '$ d' | tr -d '\n' | base64 -d
    exit-status: 0
    stdout:
    - /serviceaccount.*name.*{{.Env.BITNAMI_APP_NAME }}/
  {{ end }}
http:
  https://127.0.0.1:{{ .Vars.containerPorts.https }}/realms/master:
    status: 200
    timeout: 10000
    allow-insecure: true
    body:
      - /realm.*master/
  https://127.0.0.1:{{ .Vars.containerPorts.management }}/health:
    status: 200
    timeout: 10000
    allow-insecure: true
    body:
      - /status.*UP/
  {{ if .Vars.metrics.enabled }}
  https://127.0.0.1:{{ .Vars.containerPorts.management }}/metrics:
    status: 200
    timeout: 10000
    allow-insecure: true
    body:
      - /http_server_requests_seconds/
  https://keycloak-metrics:{{ .Vars.metrics.service.ports.metrics }}/metrics:
    status: 200
    timeout: 10000
    allow-insecure: true
    body:
      - /http_server_requests_seconds/
  {{- end }}
