#Keycloak

The Keycloak Custom Resource defines and manages a Keycloak server instance. The Operator reconciles this resource to create and maintain the Kubernetes resources required to run Keycloak, including Deployments, Services, Ingress, and Secrets.

#Resource Information

#Example

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: example-kc
  namespace: keycloak
spec:
  instances: 2
  db:
    vendor: postgres
    host: postgres-db
    usernameSecret:
      name: keycloak-db-secret
      key: username
    passwordSecret:
      name: keycloak-db-secret
      key: password
  http:
    tlsSecret: keycloak-tls-secret
  ingress:
    enabled: true
    className: nginx
    tlsSecret: keycloak-tls-secret
  hostname:
    hostname: keycloak.example.com
  proxy:
    headers: xforwarded
  additionalOptions:
    - name: metrics-enabled
      value: "true"
  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"
    limits:
      cpu: "2"
      memory: "2Gi"

#Spec Fields

#spec.instances

Number of Keycloak server replicas. Set to 2 or more for high availability. Multiple instances share session state via the embedded Infinispan cache cluster.

#spec.db

Database connection configuration.

SecretKeySelector fields:

#spec.http

HTTP and HTTPS listener configuration.

#spec.ingress

Kubernetes Ingress configuration.

#spec.hostname

Hostname and URL configuration.

#spec.proxy

Reverse proxy configuration.

#spec.resources

Compute resources for the Keycloak container.

#spec.additionalOptions

An array of key-value pairs for additional Keycloak server configuration options. Values can be direct strings or references to Secrets.

additionalOptions:
  - name: metrics-enabled
    value: "true"
  - name: log-level
    value: "INFO"
  - name: my-secret-option
    secret:
      name: my-secret
      key: option-value

Refer to the Keycloak All Configuration reference for available option names.

#spec.bootstrapAdmin

Configures the initial bootstrap administrator. Used only during initial cluster creation.

#spec.cache

Keycloak cache configuration.

#spec.features

Enable or disable specific Keycloak feature flags.

features:
  enabled:
    - "token-exchange"
    - "admin-fine-grained-authz"
  disabled:
    - "impersonation"

#spec.scheduling

Pod scheduling configuration for Keycloak Pods. Supports the same fields as Kubernetes Pod scheduling:

#spec.networkPolicy

Controls ingress traffic flow into Keycloak Pods.

#spec.livenessProbe / spec.readinessProbe

Probe configuration for the Keycloak container.

#spec.image

Custom Keycloak container image. Overrides the default image managed by the Operator.

spec:
  image: "quay.io/my-org/my-keycloak:custom-tag"

#spec.imagePullSecrets

List of Secrets to use when pulling the Keycloak image from a private registry.

spec:
  imagePullSecrets:
    - name: my-registry-secret

#spec.env

Environment variables for the Keycloak container. Use spec.additionalOptions for standard Keycloak configuration options and spec.env for non-standard or container-level variables.

spec:
  env:
    - name: JAVA_OPTS_APPEND
      value: "-Xms512m -Xmx2048m"
    - name: MY_SECRET_VAR
      secret:
        name: my-secret
        key: my-key

#Status Conditions

The Operator sets the following conditions on the Keycloak resource status: