Containerfile for Keycloak server in strict FIPS mode (OCP4)

Containerfile

FROM registry.redhat.io/rhbk/keycloak-rhel9:22-6 as builder

# What these environment variables mean:
# https://www.keycloak.org/server/all-config?f=build

# Set to appropriate database provider
ENV KC_DB=postgres

ENV KC_CACHE_STACK=kubernetes
ENV KC_FEATURES=fips,kerberos
ENV KC_FIPS_MODE=strict
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true

ADD bouncycastle /tmp/files/

WORKDIR /opt/keycloak

RUN cp /tmp/files/*.jar /opt/keycloak/providers/
RUN cp /tmp/files/keycloak-fips.keystore.* /opt/keycloak/conf/server.keystore
RUN cp /tmp/files/kc.java.security /opt/keycloak/conf/

# Consumes KC_* environment variables
RUN /opt/keycloak/bin/kc.sh build

FROM registry.redhat.io/rhbk/keycloak-rhel9:22-6

COPY --from=builder /opt/keycloak/ /opt/keycloak/

ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]