From c721a1f024ef5a8de0e6630e4043782e1dd77f56 Mon Sep 17 00:00:00 2001
From: Adam Pike <adam.pike@1password.com>
Date: Thu, 24 Mar 2022 22:36:17 -0230
Subject: [PATCH 1/3] Update container ports in Deployment manifest

Signed-off-by: Adam Pike <adam.pike@1password.com>
---
 kubernetes/op-scim-deployment.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kubernetes/op-scim-deployment.yaml b/kubernetes/op-scim-deployment.yaml
index 6089271..7595bcc 100644
--- a/kubernetes/op-scim-deployment.yaml
+++ b/kubernetes/op-scim-deployment.yaml
@@ -16,7 +16,12 @@ spec:
         - name: op-scim-bridge
           image: 1password/scim:v2.3.1
           ports:
-            - containerPort: 3002
+            # HTTPS port (external TCP traffic should be forwarded to this port by default)
+            - name: https
+              containerPort: 8443
+            # HTTP port (forward unencrypted traffic to this port if not using Let's Encrypt)
+            - name: http
+              containerPort: 3002
           volumeMounts:
             - name: scimsession
               mountPath: "/secret"

From 405354ccb192738e364d84b57e85ccf2e33ec84c Mon Sep 17 00:00:00 2001
From: Adam Pike <adam.pike@1password.com>
Date: Fri, 25 Mar 2022 12:23:24 -0230
Subject: [PATCH 2/3] Update Service spec

---
 kubernetes/op-scim-service.yaml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/kubernetes/op-scim-service.yaml b/kubernetes/op-scim-service.yaml
index 5f30d4b..0ac1ddc 100644
--- a/kubernetes/op-scim-service.yaml
+++ b/kubernetes/op-scim-service.yaml
@@ -6,17 +6,18 @@ metadata:
     app: op-scim-bridge
 spec:
   type: LoadBalancer
-  # Traffic on :80 is needed for the status page and to perform the 
-  # LetsEncrypt certificate challenges after which all SCIM traffic
-  # will be served on :443.
   ports:
+  # Use this port in the standard configuration to terminate TLS at the SCIM
+  # bridge container using Let's Encrypt
   - protocol: TCP
     name: https
     port: 443
-    targetPort: 8443
-  - protocol: TCP
-    name: http
-    port: 80
-    targetPort: 8080
+    targetPort: https
+  # Use this port when terminating TLS in front of the SCIM bridge to listen
+  # for unencrypted traffic redirected from a reverse proxy or load balancer
+  #- protocol: TCP
+  #  name: http
+  #  port: 3002
+  #  targetPort: http
   selector:
     app: op-scim-bridge

From b74f9640148c3bd434069c83aba51e09e7e05fce Mon Sep 17 00:00:00 2001
From: Adam Pike <adam.pike@1password.com>
Date: Fri, 25 Mar 2022 17:02:12 -0230
Subject: [PATCH 3/3] Update Redis ports

Signed-off-by: Adam Pike <adam.pike@1password.com>
---
 kubernetes/redis-deployment.yaml | 1 +
 kubernetes/redis-service.yaml    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/kubernetes/redis-deployment.yaml b/kubernetes/redis-deployment.yaml
index d047ffc..de68bdf 100644
--- a/kubernetes/redis-deployment.yaml
+++ b/kubernetes/redis-deployment.yaml
@@ -17,3 +17,4 @@ spec:
         image: redis:latest
         ports:
         - containerPort: 6379
+          name: redis
diff --git a/kubernetes/redis-service.yaml b/kubernetes/redis-service.yaml
index ae275f3..84f0aa5 100644
--- a/kubernetes/redis-service.yaml
+++ b/kubernetes/redis-service.yaml
@@ -7,6 +7,6 @@ metadata:
 spec:
   ports:
   - port: 6379
-    targetPort: 6379
+    targetPort: redis
   selector:
     app: op-scim-redis