#KeycloakRealmImport

The KeycloakRealmImport Custom Resource enables declarative, GitOps-friendly management of Keycloak Realm configurations. When this resource is created or updated, the Operator triggers an import Job that loads the Realm configuration into the target Keycloak instance.

#Resource Information

#Example

apiVersion: k8s.keycloak.org/v2alpha1
kind: KeycloakRealmImport
metadata:
  name: my-realm-import
  namespace: keycloak
spec:
  keycloakCRName: example-kc
  placeholders:
    CLIENT_SECRET:
      secret:
        name: my-client-secret
        key: client-secret
  realm:
    realm: my-realm
    enabled: true
    displayName: "My Application Realm"
    registrationAllowed: false
    loginWithEmailAllowed: true
    duplicateEmailsAllowed: false
    sslRequired: external
    accessTokenLifespan: 300
    clients:
      - clientId: my-app
        enabled: true
        publicClient: true
        redirectUris:
          - "https://my-app.example.com/*"
        webOrigins:
          - "https://my-app.example.com"
        secret: $(CLIENT_SECRET)

#Spec Fields

#spec.keycloakCRName

The name of the Keycloak CR in the same namespace that this Realm will be imported into.

#spec.placeholders

A map of placeholder names to Secret references. Placeholders allow injecting Secret values into the Realm configuration at import time. In the spec.realm body, reference a placeholder using the syntax $(PLACEHOLDER_NAME).

placeholders:
  CLIENT_SECRET:
    secret:
      name: my-client-secret
      key: client-secret
  SMTP_PASSWORD:
    secret:
      name: smtp-credentials
      key: password

Each placeholder value is a SecretKeySelector:

#spec.realm

The full Realm configuration to import. This corresponds to the Keycloak RealmRepresentation JSON structure. The following table describes the most commonly used fields.

#Core Realm Settings

#Token Lifespan Settings

#Security Settings

#Clients

The clients array defines OIDC/SAML clients registered in the Realm.

#Roles

Each Role object:

#Groups

Each group object supports name, path, realmRoles, clientRoles, subGroups, and attributes.

#Users

Each user object supports username, email, firstName, lastName, enabled, emailVerified, credentials, realmRoles, clientRoles, and groups.

#Identity Providers

#Authentication Flows

#Status Conditions

Check the import status:

kubectl get keycloakrealmimport <name> -n <namespace> -o yaml

A successful import shows:

status:
  conditions:
    - type: Done
      status: "True"
    - type: Started
      status: "True"
    - type: HasErrors
      status: "False"