platform/keycloak
Keycloak — the platform Identity Provider (SSO via OIDC + SAML).
- Governing ADR: ADR-0014 — IdP: Keycloak
- Spec: docs/15 — Identity & Access
- Serves: R-IDP-01..06
- Owner: WS-SEC
What this stub is
Flux HelmRelease for the Keycloak instance with PostgreSQL on Longhorn (DR-critical). Replica
count is an overlay knob (${KEYCLOAK_REPLICAS}, R-ENV-02). Admin/DB credentials referenced by
name, SOPS-encrypted (WS-SEC). Realms/clients/groups are config-as-code (Phase 6).
The ADR allows the Keycloak Operator OR Helm for the instance; this stub uses Helm — swap to the Operator if WS-SEC prefers CR-driven config.
Contract (SSO/auth)
The "SSO/auth contract" (roadmap/workstreams.md, WS-SEC): a ServiceDefinition's auth block maps to
a Keycloak client (native OIDC) or oauth2-proxy protection (forward-auth — see
../oauth2-proxy). Consumed by WS-APPS/WS-C2.
TODO (later phases — onboarded EARLY in Phase 6)
- Realms/clients/groups as code (keycloak-config-cli / realm-import); MFA for privileged groups.
- DR-critical: off-cluster DB backup (velero/) + documented break-glass local-admin path.
- Exceptions that keep native auth (do not force SSO): Plex/Seerr (Plex auth), Minecraft (Mojang/Microsoft), UniFi (native) — ADR-0014.