Operator

Keycloak

Identity and access management for your applications: single sign-on over OpenID Connect and SAML, user federation and identity brokering. Deployed and upgraded by the Keycloak Operator.

Operator-managed install
OIDC · OAuth 2.0 · SAML 2.0
External PostgreSQL database
Clustered instances

Install the Operator Talk to an engineer

No credit card required · Free during the Alpha phase · View pricing

Overview

One identity provider for the applications you run.

Single sign-on

Applications delegate login to Keycloak over OpenID Connect, OAuth 2.0 or SAML 2.0, and receive tokens or assertions instead of handling passwords.

Users and federation

Store users in Keycloak, federate an existing LDAP or Active Directory, or broker login to external identity providers.

Realms and policies

Each realm isolates its users, clients, roles and login settings — including password policies and multi-factor authentication.

Deployment

The Operator turns a Keycloak custom resource into a running, clustered server.

Subscription

OperatorHub → Keycloak Operator, into your namespace

Database + TLS

PostgreSQL credentials and a TLS certificate as Secrets

Keycloak CR

Instances, hostname, database, TLS

Keycloak pods

StatefulSet, Service and ingress, reconciled by the Operator

Namespace-scoped Operator — the Operator is installed into the namespace that will run Keycloak and watches only that namespace. Subscribing needs cluster-admin rights on your cluster.
Database first — the Operator does not provision a database. Point spec.db at a PostgreSQL instance, such as one deployed from the PostgreSQL template or the managed database service.
Hostname and TLS — set spec.hostname and reference a TLS Secret in spec.http.tlsSecret.
Initial admin — the Operator writes temporary admin credentials to the -initial-admin Secret. Replace them after first login.
Realms as code — import realm configuration with a KeycloakRealmImport resource.

bash — oc

# database credentials for Keycloak
$ oc create secret generic keycloak-db \
    --from-literal=username=keycloak \
    --from-literal=password=''

# after installing the Operator into this namespace:
$ oc apply -f - <<'EOF'
apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: sso
spec:
  instances: 2
  db:
    vendor: postgres
    host: postgresql
    database: keycloak
    usernameSecret: { name: keycloak-db, key: username }
    passwordSecret: { name: keycloak-db, key: password }
  http:
    tlsSecret: sso-tls
  hostname:
    hostname: sso.example.com
EOF

# temporary admin login
$ oc extract secret/sso-initial-admin --to=-

Platform integration

An identity provider next to the applications that use it.

Clustering — with instances above 1, the pods form a cluster and share session and cache state; the database holds persistent configuration and users.
Upgrades — the Operator rolls the Keycloak pods to the version it ships when the Operator itself is updated through its Subscription channel. Back up the database before an upgrade.
In-cluster clients — applications in the cluster reach Keycloak over its Service; browsers and external clients use the configured hostname.
Connect applications — register GitLab, Nextcloud and your own Node.js services as OIDC or SAML clients for one login across them.

Run your identity provider in your own cluster.

Install the Keycloak Operator, connect a PostgreSQL database, apply a Keycloak resource.

Install the Operator Talk to an engineer

Hosted in the Netherlands · EU data residency · 100% renewable energy

Far far away, behind the word moun tains, far from the countries Vokalia and Consonantia, there live the blind texts. Separated they live in Bookmarksgrove right at the coast of

759 Pinewood Avenue
Marquette, Michigan
info@domain.com
Online Support
906-624-2565
Mon-Fri 8am-5pm

Purchase Now