Keycloak Operator on Kubernetes without Helm, with Kapitan

The Keycloak Operator 26.8.1, watching every namespace, with its RBAC and optionally its CRDs, rendered by the kadet-hub kubernetes generator 1.9.0. Derived from the Keycloak project’s operator chart, which the keycloak recipe requires.

Source chart: oci://quay.io/keycloak/keycloak-operator-helm:26.8.1@sha256:650f7e1021def78ff799aa5ada703818a1a7d0e3cb6ee7eba6d5e1b557656a17
Proof level: deploys, compared with the chart by the kadet-hub/recipes CI
Generators: kubernetes 1.9.0 sha256:987694d4d8b061a6937fb5b8acd17416a16ed3fea36786a7604e6d607c210e24

What it deploys

recipes.keycloak-operator (init.yml)
recipes.keycloak-operator.keycloak-operator (keycloak-operator.yml): keycloak-operator
recipes.keycloak-operator.crds (crds.yml), an option

Required parameters

No parameter has to be set.

Include

A target includes the recipe and its options as classes and can override anything the recipe sets:

classes:
  - recipes.keycloak-operator
  - recipes.keycloak-operator.crds   # the chart's crds.enabled
parameters:
  namespace: keycloak-operator
  kapitan:
    vars:
      target: keycloak-operator

Fetching it

Until this recipe is published as an OCI artifact, a separate fetch inventory pins kadet-hub/recipes by commit. This is fetch/targets/recipes.yml at the commit the page was built from:

parameters:
  kapitan:
    vars:
      target: recipes
    dependencies:
      - type: git
        source: https://github.com/kadet-hub/recipes.git
        ref: 21d393a220614c2e353c431ae0c3bff4b8485c90
        subdir: keycloak-operator
        output_path: inventory/classes/recipes/keycloak-operator

The first command fetches the recipe into inventory/classes/recipes/keycloak-operator, the second the generators and compiles:

kapitan compile --inventory-path fetch --fetch --output-path .
kapitan compile --fetch

The first command exits with status 1 because the fetch target compiles nothing. Kapitan's --fetch checks neither the digest nor the attestation of a generator. Using a recipe describes how to verify them and how to raise the pin.

Settings

Chart value	Inventory
`namespace` (release namespace)	`namespace`
`operator.image`	`components.keycloak-operator.image`, tag and digest
`operator.envs.RELATED_IMAGE_KEYCLOAK`, `operator.envs.kc.operator.keycloak.image`	`applications.keycloak-operator.keycloak_image`, the image of a `Keycloak` resource that sets none
`operator.envs.QUARKUS_OPERATOR_SDK_CONTROLLERS_<controller>_NAMESPACES`	`components.keycloak-operator.env.QUARKUS_OPERATOR_SDK_CONTROLLERS_<controller>_NAMESPACES`, a comma-separated list of namespaces in place of `JOSDK_ALL_NAMESPACES`
`operator.replicas`	`components.keycloak-operator.replicas`
`operator.resources`	`components.keycloak-operator.resources`
`crds.enabled`	the class `recipes.keycloak-operator.crds`

A narrowed watch keeps the ClusterRoles of the chart.

Renamed RBAC objects

The kubernetes generator names a role and its binding after the entry, and every entry starts with the recipe’s name.

Chart	Recipe
ClusterRoleBinding `keycloak-operator-clusterrole-binding`	`keycloak-operator-clusterrole`
ClusterRole `keycloakcontroller-cluster-role`, ClusterRoleBinding `keycloakcontroller-role-binding`	`keycloak-operator-keycloakcontroller`
ClusterRole `keycloakrealmimportcontroller-cluster-role`, ClusterRoleBinding `keycloakrealmimportcontroller-role-binding`	`keycloak-operator-keycloakrealmimportcontroller`
ClusterRole `keycloakoidcclientcontroller-cluster-role`, ClusterRoleBinding `keycloakoidcclientcontroller-role-binding`	`keycloak-operator-keycloakoidcclientcontroller`
ClusterRole `keycloaksamlclientcontroller-cluster-role`, ClusterRoleBinding `keycloaksamlclientcontroller-role-binding`	`keycloak-operator-keycloaksamlclientcontroller`

Proof

check keycloak-operator --level deploys with tests/values.yaml and tests/target.yml, on kind kindest/node:v1.37.0.

tests/smoke creates a Keycloak resource in default and waits for the operator to create its StatefulSet with the default image.

The recipe's files are in kadet-hub/recipes. All recipes