keycloak

Renders Keycloak Operator Keycloak instances and KeycloakRealmImports from inventory parameters.

Latest: 1.0.3 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 18 · 454 pulls

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/keycloak/badge.json)](https://kadet-hub.org/generators/keycloak/)

Keycloak Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Built for Keycloak Operator 26.8.1. Keycloak and KeycloakRealmImport are emitted as k8s.keycloak.org/v2beta1, their storage version; v2alpha1 of these kinds is still served but deprecated. KeycloakOIDCClient and KeycloakSAMLClient exist only as v2alpha1 (served, storage, not deprecated) and are an upstream alpha (preview) API. The bundled JSON Schemas are Apache-2.0, derived from the upstream CRDs.

Kapitan kadet generator for the Keycloak Operator:

Keycloak: a Keycloak server with database, hostname, TLS, ingress, cache, features and scheduling
KeycloakRealmImport: a realm created on import, with clients, client scopes, roles, groups and identity providers declared as maps that merge across classes
KeycloakOIDCClient, KeycloakSAMLClient (upstream alpha): clients the operator creates, updates and deletes through the Admin API v2

The database, the TLS Secret and the database credentials Secret belong in other generators or operators (for example CloudNativePG and cert-manager).

Usage

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keycloak@sha256:<digest>
        output_path: lib/keycloak
    compile:
      - output_path: manifests/keycloak/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/keycloak

Inventory contract

All keys live under parameters.generators.keycloak.

Key	Kind	Output key
`namespace`		Default namespace. Falls back to `parameters.namespace`, then `default`.
`instances.<name>`	Keycloak	`<namespace>/<name>-keycloak`
`realm_imports.<name>`	KeycloakRealmImport	`<namespace>/<name>-keycloakrealmimport`
`oidc_clients.<name>`	KeycloakOIDCClient	`<namespace>/<name>-keycloakoidcclient`
`saml_clients.<name>`	KeycloakSAMLClient	`<namespace>/<name>-keycloaksamlclient`

Every entry accepts namespace, labels, annotations and spec. Precedence, lowest first: generator defaults, spec, flat keys and shorthands; a flat key that overrides a spec value logs a warning.

Keycloak

Key	CRD field
`instances`	`instances`
`image`, `image_pull_secrets`	`image`, `imagePullSecrets`
`additional_options`	`additionalOptions`
`proxy`, `unsupported`	`proxy`, `unsupported`, verbatim
`db`	`db`: `vendor`, `host`, `port`, `database`, `schema`, `url`, `pool_initial_size`, `pool_min_size`, `pool_max_size`, `username_secret`, `password_secret`, `credentials_secret`
`hostname`	`hostname`: `hostname`, `admin`, `admin_url`, `strict`, `strict_backchannel`, `backchannel_dynamic`
`http`	`http`: `http_enabled`, `http_port`, `https_port`, `tls_secret`
`ingress`	`ingress`: `enabled`, `class_name`, `annotations`
`features`	`features`: `enabled`, `disabled`
`transaction`	`transaction`: `xa_enabled`
`cache`	`cache`: `config_map_file`
`resources`	`resources`: `requests`, `limits`
`scheduling`	`scheduling`: `affinity`, `tolerations`, `priority_class_name`

Section keys are the snake_case spelling of the CRD field. Other keys inside a section, for example scheduling.topologySpreadConstraints or http.serviceName, pass through verbatim. Fields without a flat key, such as startOptimized, bootstrapAdmin, truststores or networkPolicy, go into spec.

KeycloakRealmImport

Key	CRD field
`keycloak_cr_name`	`keycloakCRName`
`realm`	`realm`, a full RealmRepresentation
`clients.<clientId>`, `client_scopes.<name>`, `roles.realm.<name>`, `roles.client.<clientId>.<name>`, `groups.<name>`, `identity_providers.<alias>`	`realm.clients`, `realm.clientScopes`, `realm.roles`, `realm.groups`, `realm.identityProviders`

The maps are keyed by the entry’s identifier and merge across Kapitan classes, so a class can add one client without repeating the others. Lists are sorted by identifier. An entry whose identifier already exists in realm merges into it and the map wins with a warning. Entry keys in snake_case map to camelCase:

Map	Flat keys
`clients`	`admin_url`, `base_url`, `bearer_only`, `client_authenticator_type`, `consent_required`, `default_client_scopes`, `direct_access_grants_enabled`, `frontchannel_logout`, `full_scope_allowed`, `implicit_flow_enabled`, `optional_client_scopes`, `protocol_mappers`, `public_client`, `redirect_uris`, `root_url`, `service_accounts_enabled`, `standard_flow_enabled`, `web_origins`
`client_scopes`	`protocol_mappers`
`groups`	`realm_roles`, `client_roles`, `sub_groups` (a map of nested groups)
`identity_providers`	`display_name`, `first_broker_login_flow_alias`, `hide_on_login`, `link_only`, `post_broker_login_flow_alias`, `provider_id`, `store_token`, `trust_email`

secret_ref on a client and client_secret_ref on an identity provider take a Secret key reference. They render secret: ${CLIENT_SECRET_<clientId>} or config.clientSecret: ${IDP_CLIENT_SECRET_<alias>} and add the matching spec.placeholders entry, so the secret reaches neither the inventory nor the compiled manifest. Names are upper-cased with other characters as _; two refs that resolve to the same name with different Secrets fail the compile. Users are not modelled; user credentials or client secrets written into realm log a warning.

The operator only creates realms that do not exist yet; it never updates or deletes them.

KeycloakOIDCClient and KeycloakSAMLClient

Key	CRD field
`keycloak_cr_name`	`keycloakCRName`
`realm`	`realm`, the realm the client lives in
`client`	`client`, verbatim: the Admin API v2 client representation, for example `loginFlows`, `redirectUris`, `webOrigins` and `auth` (OIDC) or `nameIdFormat`, `signDocuments`, `signAssertions` (SAML)

The entry key becomes metadata.name, which the operator uses as clientId. clientId, realm and keycloakCRName cannot change after creation. client replaces spec.client as a whole, it is not merged.

The generator adds nothing to client: no secret, no loginFlows, no redirect URIs or web origins, so public clients, wildcard redirects and direct access grants exist only when the inventory writes them. A confidential client references its secret with client.auth.secretRef; that Secret needs the label operator.keycloak.org/kind: KeycloakOIDCClient and comes from elsewhere.

The guide’s prerequisites are not defaulted either: the referenced Keycloak needs features.enabled: [client-admin-api:v2], and the operator reads admin client credentials from the Secret <keycloak_cr_name>-admin (keys client-id, client-secret), which has to be created during admin bootstrap. Anyone who can write these CRs can do what those admin credentials allow.

Defaults and shorthands

Input	Result	Source
`db.credentials_secret: <name>`	`usernameSecret: {name: <name>, key: username}`, `passwordSecret: {name: <name>, key: password}`	the keys of a `kubernetes.io/basic-auth` Secret, as in the operator’s basic deployment; `username_secret` and `password_secret` win
realm import without `realm.realm`	`realm.realm: <entry key>`	the operator names the import Secret after it
realm import or client without `keycloak_cr_name`	`keycloakCRName` of the only Keycloak in `instances` with the same namespace	required by all three CRDs; the operator looks it up in the resource’s namespace

With zero or several instances in the namespace, keycloak_cr_name stays unset and the resource fails QA-7 at compile time until the inventory names one. A client’s realm has no default: QA-7 fails without it.

The operator’s basic deployment guide lists a database, a hostname and a TLS certificate as prerequisites. The generator defaults none of them, sets no admin password, and never turns off hostname.strict or turns on http.http_enabled: each of these weakens or bypasses authentication, so the inventory has to opt in. The CRD marks none of them required, so QA-7 does not catch a missing one. proxy.headers is not defaulted either; the guide warns that forwarded headers can be spoofed unless network policies restrict the HTTP port. The operator creates the initial admin in the Secret <name>-initial-admin with a generated password.

instances is emitted only when set. The operator default is 1, and leaving it out lets kubectl scale or an HPA own the replica count.

Example

parameters:
  namespace: identity
  generators:
    keycloak:
      instances:
        sso:
          instances: 3
          db:
            vendor: postgres
            host: keycloak-db-rw
            database: app
            credentials_secret: keycloak-db-app
          hostname:
            hostname: sso.example.com
          http:
            tls_secret: sso-tls
          ingress:
            class_name: nginx
            annotations:
              nginx.ingress.kubernetes.io/backend-protocol: HTTPS
              nginx.ingress.kubernetes.io/ssl-passthrough: "true"
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              memory: 2Gi
      realm_imports:
        apps:
          realm:
            enabled: true
            sslRequired: external
            bruteForceProtected: true
          clients:
            portal:
              public_client: true
              redirect_uris:
                - https://portal.example.com/*
              web_origins:
                - https://portal.example.com
              attributes:
                pkce.code.challenge.method: S256
            orders-api:
              standard_flow_enabled: false
              service_accounts_enabled: true
              secret_ref:
                name: orders-api-oidc
                key: client-secret
          roles:
            realm:
              admin:
                description: Administrator role
          groups:
            platform:
              realm_roles:
                - admin

This renders identity/sso-keycloak and identity/apps-keycloakrealmimport; the import gets realm: apps and keycloakCRName: sso from the defaults above.

tests/fixtures/inventory/targets/complete.yml covers every section, two instances in one namespace with an explicit keycloak_cr_name, Secret refs, OIDC and SAML clients and flat keys overriding spec.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.3	Keycloak Operator 26.8.1
1.0.2	Keycloak Operator 26.8.0
1.0.1	Keycloak Operator 26.8.0
1.0.0	Keycloak Operator 26.8.0

1.0.3# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keycloak:1.0.3@sha256:0902cc8a796e2a1d1708c7f9975e41e8422d0d1edff7f873faa5ecaeced13dfd
        output_path: lib/keycloak

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keycloak@sha256:0902cc8a796e2a1d1708c7f9975e41e8422d0d1edff7f873faa5ecaeced13dfd \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274966561, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): Keycloak Operator 26.8.1
Source: keycloak-v1.0.3 · cdce4e91961d7eebbe43e96d2f89b720a59efe4f · keycloak
Binaries: none
Output capabilities: none
Digest: sha256:0902cc8a796e2a1d1708c7f9975e41e8422d0d1edff7f873faa5ecaeced13dfd

Checks

Checked by the release run on 2026-10-16, gate at a31e96336fac.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.2: 0 files, 0 hunks.

Output diff

1.0.2# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keycloak:1.0.2@sha256:ef3d3f82134cdb3e78e8487ac083f43134293e00d078aeb7355d5dadc8a3b385
        output_path: lib/keycloak

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keycloak@sha256:ef3d3f82134cdb3e78e8487ac083f43134293e00d078aeb7355d5dadc8a3b385 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250238740, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Keycloak Operator 26.8.0
Source: keycloak-v1.0.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · keycloak
Binaries: none
Output capabilities: none
Digest: sha256:ef3d3f82134cdb3e78e8487ac083f43134293e00d078aeb7355d5dadc8a3b385

Checks

Checked by the release run on 2026-10-14, gate at 8fbfd22097fa.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keycloak:1.0.1@sha256:1c00442658e11cf4592c615a7dd4dff499e10490dfd861632486d35605b30916
        output_path: lib/keycloak

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keycloak@sha256:1c00442658e11cf4592c615a7dd4dff499e10490dfd861632486d35605b30916 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244111394, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Keycloak Operator 26.8.0
Source: keycloak-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · keycloak
Binaries: none
Output capabilities: none
Digest: sha256:1c00442658e11cf4592c615a7dd4dff499e10490dfd861632486d35605b30916

Checks

Checked by the release run on 2026-10-13, gate at ebaee1d1d6a0.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/keycloak:1.0.0@sha256:5266084035839494ced231bcee139af679241acce93c648f900e9abf11f06488
        output_path: lib/keycloak

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/keycloak@sha256:5266084035839494ced231bcee139af679241acce93c648f900e9abf11f06488 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3214146151, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Keycloak Operator 26.8.0
Source: keycloak-v1.0.0 · dccb03cf01fd06f12e450d884b7e415e8aa2e959 · keycloak
Binaries: none
Output capabilities: none
Digest: sha256:5266084035839494ced231bcee139af679241acce93c648f900e9abf11f06488

Checks

Checked by the release run on 2026-10-11, gate at ba56b80d2115.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.