Initial commit

apps/guacamole/manifests/deployment-complete.yaml

@@ -0,0 +1,256 @@
+# Guacamole complete deployment with OpenID/Authentik support
+# This deployment includes:
+# - Environment-based OpenID configuration
+# - PostgreSQL backend for connections/users
+# - Authentik uses Let's Encrypt (no custom cert import needed)
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: guacamole
+  namespace: guacamole
+  labels:
+    app: guacamole
+    component: client
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: guacamole
+      component: client
+  template:
+    metadata:
+      labels:
+        app: guacamole
+        component: client
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: guacamole
+          image: guacamole/guacamole:1.6.0
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: tomcat-work
+              mountPath: /usr/local/tomcat/work
+            - name: tomcat-logs
+              mountPath: /usr/local/tomcat/logs
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: GUACD_HOSTNAME
+              value: "guacd"
+            - name: GUACD_PORT
+              value: "4822"
+            - name: POSTGRESQL_HOSTNAME
+              value: "pg-guacamole-rw"
+            - name: POSTGRESQL_PORT
+              value: "5432"
+            - name: POSTGRESQL_DATABASE
+              value: "guacamole"
+            - name: POSTGRESQL_ENABLED
+              value: "true"
+            - name: POSTGRESQL_USERNAME
+              value: "guacamole"
+            - name: POSTGRESQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: pg-guacamole-app
+                  key: password
+            - name: POSTGRESQL_AUTO_CREATE_ACCOUNTS
+              value: "true"
+            - name: ENABLE_ENVIRONMENT_PROPERTIES
+              value: "true"
+            - name: LOG_LEVEL
+              value: "debug"
+            - name: WEBAPP_CONTEXT
+              value: "ROOT"
+            # FIX: Enabled WebSockets to stop the 10-second tunnel timeout
+            - name: ENABLE_WEBSOCKET
+              value: "true"
+            - name: EXTENSION_PRIORITY
+              value: "*,openid"
+            - name: OPENID_RESPONSE_TYPE
+              value: "code"
+            - name: OPENID_AUTHORIZATION_ENDPOINT
+              value: "https://auth.kube.huskypup.net/application/o/authorize/"
+            - name: OPENID_JWKS_ENDPOINT
+              value: "https://auth.kube.huskypup.net/application/o/guacamole/jwks/"
+            - name: OPENID_ISSUER
+              value: "https://auth.kube.huskypup.net/application/o/guacamole/"
+            - name: OPENID_TOKEN_ENDPOINT
+              value: "https://auth.kube.huskypup.net/application/o/token/"
+            - name: OPENID_REDIRECT_URI
+              value: "https://guacamole.kube.huskypup.net/"
+            - name: OPENID_USERNAME_CLAIM_TYPE
+              value: "preferred_username"
+            - name: OPENID_GROUPS_CLAIM_TYPE
+              value: "groups"
+            - name: OPENID_SCOPE
+              value: "openid email profile groups"
+            - name: OPENID_ALLOWED_CLOCK_SKEW
+              value: "30"
+            - name: OPENID_MAX_TOKEN_VALIDITY
+              value: "300"
+            - name: OPENID_MAX_NONCE_VALIDITY
+              value: "60"
+            - name: OPENID_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: guacamole-oauth-secret
+                  key: client-id
+            - name: OPENID_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: guacamole-oauth-secret
+                  key: client-secret
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          livenessProbe:
+            httpGet:
+              path: /api/languages
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          # FIX: Relaxed readiness probe so minor DB lags don't kill the Endpoint
+          readinessProbe:
+            httpGet:
+              path: /api/languages
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 15
+            failureThreshold: 5
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: tomcat-work
+          emptyDir: {}
+        - name: tomcat-logs
+          emptyDir: {}
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: guacd
+  namespace: guacamole
+  labels:
+    app: guacamole
+    component: guacd
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: guacamole
+      component: guacd
+  template:
+    metadata:
+      labels:
+        app: guacamole
+        component: guacd
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: guacd
+          image: guacamole/guacd:1.6.0
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: home
+              mountPath: /home
+          ports:
+            - name: guacd
+              containerPort: 4822
+              protocol: TCP
+          env:
+            - name: LOG_LEVEL
+              value: "debug"
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "10m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          readinessProbe:
+            tcpSocket:
+              port: 4822
+            initialDelaySeconds: 2
+            periodSeconds: 10
+            timeoutSeconds: 1
+            successThreshold: 1
+            failureThreshold: 3
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: home
+          emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: guacamole
+  namespace: guacamole
+  labels:
+    app: guacamole
+    component: client
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: guacamole
+    component: client
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: guacd
+  namespace: guacamole
+  labels:
+    app: guacamole
+    component: guacd
+spec:
+  type: ClusterIP
+  ports:
+    - port: 4822
+      targetPort: guacd
+      protocol: TCP
+      name: guacd
+  selector:
+    app: guacamole
+    component: guacd