--- # Keycloak CONTROLLERS half (F-MON1 split): the official Keycloak Operator (quay.io images) + its # CRDs + the SOPS-encrypted admin credential. The Keycloak/KeycloakRealmImport CUSTOM RESOURCES live # in ../../platform-config (dependsOn platform) so the CRDs registered here exist first. # # IMAGE STRATEGY (DECISIONS-LOG F-KY1): the old stub used the Bitnami Keycloak chart + bundled Bitnami # PostgreSQL; Bitnami's free Docker Hub images were purged -> ImagePullBackOff. Replaced with the # official Keycloak Operator (quay.io/keycloak/keycloak-operator + quay.io/keycloak/keycloak) and # CloudNativePG (ghcr.io) for the DB (platform/cnpg) — both registries unaffected by the purge, and # the Operator gives declarative Keycloak/realm CRs (R-IDP-03) + CNPG gives DR backup hooks (R-IDP-05). # # The operator manifests are pinned upstream RELEASE files pulled as remote bases (the same pattern the # kubevirt stub documents). Renovate maintains the version. Offline `kubectl kustomize` fetches them; # Flux fetches them at reconcile. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization # Force the operator's namespaced resources (ServiceAccount/Role/RoleBinding/Service/Deployment, which # ship without an explicit namespace) into `keycloak`. CRDs + ClusterRoles are cluster-scoped and pass # through unchanged; the ClusterRoleBinding subject already targets namespace keycloak. namespace: keycloak resources: - namespace.yaml # --- Keycloak Operator v26.8.2 (pinned upstream release manifests) --- # The operator, its CRDs and the SERVER IMAGE move in lockstep: the Keycloak CR has no # spec.image, so the operator's RELATED_IMAGE_KEYCLOAK (quay.io/keycloak/keycloak:) # is what runs. These URLs are therefore THE Keycloak version. Each carries a Renovate # marker (custom.regex manager, renovate.json5) under ONE depName, so all of them bump in ONE # branch, never auto-merged (packageRule "keycloak-operator"). Before merging a bump, re-check # passkey-reconciler.yaml's 26.0.6 Admin API assumptions — see README.md "Upgrading Keycloak". # # THE URL LIST MUST MATCH UPSTREAM'S kubernetes/kustomization.yml AT THE NEW TAG — Renovate only # rewrites the version in the URLs that are here; it cannot add a CRD the new release introduced. # 26.0.6 shipped 2 CRDs; 26.8.2 ships 4 (+ keycloakoidcclients, keycloaksamlclients, both # v2alpha1). PR #121 bumped only the existing three URLs, and the 26.8.2 operator — which starts an # informer for EVERY kind it controls, used or not — CrashLooped on # `Couldn't start informer for keycloaksamlclients.k8s.keycloak.org/v2alpha1 ... Not Found`, # stalling Flux `platform` and everything downstream (2026-11-08). On every bump, diff # https://github.com/keycloak/keycloak-k8s-resources/tree//kubernetes # against this list before merging. # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloaks.k8s.keycloak.org-v1.yml # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloakoidcclients.k8s.keycloak.org-v1.yml # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/keycloaksamlclients.k8s.keycloak.org-v1.yml # renovate: datasource=github-tags depName=keycloak/keycloak-k8s-resources - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.8.2/kubernetes/kubernetes.yml # --- Admin (break-glass) credential — SOPS-encrypted, referenced by name (ADR-0007, R-IDP-04) --- - keycloak-admin-credentials.sops.yaml # --- OIDC client secrets (grafana + oauth2-proxy) the realm import injects via placeholders --- - keycloak-realm-clients.sops.yaml # --- PER-ENVIRONMENT S3 credential for the keycloak-db CNPG Barman backup (R-IDP-05), split # 2026-09-07. SOPS-encrypted, decrypted by the `platform` tier (which already has the # decryption stanza). BOTH land in ns keycloak on BOTH clusters; the keycloak-db Cluster # (platform-config) selects ONE by name via # `keycloak-db-backup-credentials${BACKUP_CREDENTIALS_SUFFIX}` (cluster-vars: dev "", # prod "-prod"). Two objects, so an R2 token rotation cannot silently break dev's MinIO # WAL archiving — and archive_mode=on makes a broken archive a disk-full clock, not a # degraded backup (see postgres-cluster.yaml). # dev -> keycloak-db-backup-credentials (MinIO, s3://cnpg) # prod -> keycloak-db-backup-credentials-prod (Cloudflare R2, s3://k3s-prod-backup/barman) - keycloak-db-backup-credentials.sops.yaml - keycloak-db-backup-credentials-prod.sops.yaml # --- Grafana dashboard for Keycloak health (plain ConfigMap; R-OBS-03) --- - grafana-dashboard.yaml # --- Operator memory: upstream ships requests=limits=450Mi, which this cluster outgrew ON 26.0.6 --- # Measured on prod 2026-11-08: the 26.0.6 operator pod had 154 restarts in 64d, lastState # `OOMKilled` (exit 137, 2026-11-07T23:09:54Z), and sat at 421Mi of its 450Mi (94%) in `kubectl top`. # 26.8.2 keeps the same 450Mi default but runs FOUR controllers/informers instead of two (adds # keycloakoidcclient + keycloaksamlclient) on a newer Quarkus (3.15.1 -> 3.40.1.1), so it would # plausibly start above a ceiling 26.0.6 already crossed. Limit 768Mi = ~1.8x the observed 421Mi # working set; request 512Mi = the observed working set plus headroom, so the scheduler reserves what # it actually uses. Revisit with `kubectl top` once 26.8.2 has run for a week. Patched here (not in # the remote kubernetes.yml) so a Renovate bump keeps it. patches: - target: kind: Deployment name: keycloak-operator patch: |- - op: replace path: /spec/template/spec/containers/0/resources/limits/memory value: 768Mi - op: replace path: /spec/template/spec/containers/0/resources/requests/memory value: 512Mi