Kubernetes Keycloak

Deploys Keycloak on Kubernetes as an identity and access management solution. Provisions a Keycloak instance with configurable container resources, optional namespace creation, and optional external access through ingress with TLS. Keycloak provides single sign-on, identity brokering, user federation, and fine-grained authorization for applications and services.

What Gets Created

When you deploy a KubernetesKeycloak resource, OpenMCF provisions:

• Kubernetes Namespace — created if createNamespace is true
• Keycloak Deployment — a Keycloak application instance with:
  • A Keycloak pod running with the configured CPU and memory resources
  • Kubernetes Service for cluster-internal access on port 8080
  • Admin password stored in a Kubernetes Secret ({name}-password)
  • PostgreSQL database password stored in a Kubernetes Secret ({name}-db-password)
• Ingress Resources (when ingress.enabled is true):
  • External LoadBalancer service ({name}-external-lb) for routing traffic to Keycloak
  • TLS-terminated external access at the configured hostname

Prerequisites

• A Kubernetes cluster with kubectl configured for access
• Ingress controller installed in the cluster (only if using ingress)
• cert-manager or equivalent TLS provider (only if using ingress with HTTPS)

Quick Start

Create a file keycloak.yaml:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesKeycloak
metadata:
  name: my-keycloak
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.KubernetesKeycloak.my-keycloak
spec:
  namespace:
    value: keycloak-dev
  createNamespace: true

Deploy:

openmcf apply -f keycloak.yaml

This creates a Keycloak instance with default resources (1 CPU / 1Gi memory limit, 50m CPU / 100Mi memory request) in the keycloak-dev namespace.

Configuration Reference

Required Fields

Optional Fields

Examples

Keycloak with Custom Resources

Increase CPU and memory for a Keycloak instance handling a larger user base:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesKeycloak
metadata:
  name: auth-keycloak
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.KubernetesKeycloak.auth-keycloak
spec:
  namespace:
    value: auth-services
  createNamespace: true
  container:
    resources:
      limits:
        cpu: "2000m"
        memory: "4Gi"
      requests:
        cpu: "500m"
        memory: "1Gi"

Keycloak with Namespace Reference

Use valueFrom to reference a namespace managed by a separate KubernetesNamespace resource:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesKeycloak
metadata:
  name: shared-keycloak
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: staging.KubernetesKeycloak.shared-keycloak
spec:
  namespace:
    valueFrom:
      kind: KubernetesNamespace
      metadata:
        name: platform-ns
      fieldPath: spec.name
  container:
    resources:
      limits:
        cpu: "2000m"
        memory: "2Gi"
      requests:
        cpu: "250m"
        memory: "512Mi"

Full-Featured with Ingress

External access over HTTPS for production use:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesKeycloak
metadata:
  name: prod-keycloak
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesKeycloak.prod-keycloak
spec:
  namespace:
    value: production
  createNamespace: true
  container:
    resources:
      limits:
        cpu: "4000m"
        memory: "8Gi"
      requests:
        cpu: "1000m"
        memory: "2Gi"
  ingress:
    enabled: true
    hostname: keycloak.example.com

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• KubernetesNamespace — pre-create a namespace to reference via valueFrom
• KubernetesPostgres — deploy PostgreSQL as the backing database for Keycloak
• KubernetesJenkins — integrate Jenkins CI/CD with Keycloak for authentication