apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: codeready-workspaces
spec:
  server:
    # defaults to `che`. When set to `codeready`, CodeReady Workspaces is deployed
    # the difference is in images, labels, exec commands
    cheFlavor: 'codeready'
    # when set to true the operator will attempt to get a secret in OpenShift router namespace
    # to add it to Java trust store of Che server. Requires cluster-admin privileges for operator service account
    selfSignedCert: true
    # TLS mode for Che. Make sure you either have public cert, or set selfSignedCert to true
    tlsSupport: true

  auth:
    # instructs operator on whether or not to deploy Keycloak/RH SSO instance. When set to true provision connection details
    externalIdentityProvider: true
    # retrieved from respective route/ingress unless explicitly specified in CR (when ExternalKeycloak is true)
    identityProviderURL: 'replace_me'
    # desired admin username of Keycloak admin user (applicable only when externalIdentityProvider is false)
    identityProviderAdminUserName: ''
    # desired password of Keycloak admin user (applicable only when externalIdentityProvider is false)
    identityProviderPassword: ''
    # name of a keycloak realm. This realm will be created, when externalIdentityProvider is true, otherwise passed to Che server
    identityProviderRealm: 'a_realm'
    # id of a keycloak client. This client will be created, when externalIdentityProvider is false, otherwise passed to Che server
    identityProviderClientId: 'codeready'