jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
31 lines
1.4 KiB
Markdown
31 lines
1.4 KiB
Markdown
# platform/keycloak
|
|
|
|
**Keycloak** — the platform Identity Provider (SSO via OIDC + SAML).
|
|
|
|
- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
|
|
- **Spec:** [docs/15 — Identity & Access](../../../home-network-k3s/docs/15-identity-and-access.md)
|
|
- **Serves:** R-IDP-01..06
|
|
- **Owner:** WS-SEC
|
|
|
|
## What this stub is
|
|
|
|
Flux `HelmRelease` for the Keycloak instance with **PostgreSQL on Longhorn** (DR-critical). Replica
|
|
count is an overlay knob (`${KEYCLOAK_REPLICAS}`, R-ENV-02). Admin/DB credentials referenced **by
|
|
name**, **SOPS-encrypted** (WS-SEC). Realms/clients/groups are config-as-code (Phase 6).
|
|
|
|
> The ADR allows the **Keycloak Operator OR Helm** for the instance; this stub uses Helm — swap to
|
|
> the Operator if WS-SEC prefers CR-driven config.
|
|
|
|
## Contract (SSO/auth)
|
|
|
|
The "SSO/auth contract" (`roadmap/workstreams.md`, WS-SEC): a ServiceDefinition's `auth` block maps to
|
|
a Keycloak client (native OIDC) or oauth2-proxy protection (forward-auth — see
|
|
[`../oauth2-proxy`](../oauth2-proxy)). Consumed by WS-APPS/WS-C2.
|
|
|
|
## TODO (later phases — onboarded EARLY in Phase 6)
|
|
|
|
- Realms/clients/groups as code (keycloak-config-cli / realm-import); MFA for privileged groups.
|
|
- **DR-critical:** off-cluster DB backup (velero/) + documented **break-glass** local-admin path.
|
|
- Exceptions that keep native auth (do not force SSO): Plex/Seerr (Plex auth), Minecraft
|
|
(Mojang/Microsoft), UniFi (native) — ADR-0014.
|