Skip to content

Conversation

@sandeepbh5
Copy link
Contributor

Description

  • Introduced a new Keycloak operator application with a sync wave for managing Keycloak instances via CRDs.
  • Updated Keycloak tenant controller to use the latest target revision.
  • Modified platform Keycloak application to point to the new chart repository and updated target revision.
  • Enhanced Traefik extra objects to use the latest target revision.
  • Added default admin username in the on-prem installer functions.
  • Enabled Keycloak operator in the platform profile configuration.
  • Updated Trivy configuration to suppress specific false positives related to Keycloak operator permissions and ExternalName services.

Any Newly Introduced Dependencies

  • quay.io/keycloak/keycloak:26.4.5
  • quay.io/keycloak/keycloak-operator:26.4.5

How Has This Been Tested?

Coder

Checklist:

  • I agree to use the APACHE-2.0 license for my code changes
  • I have not introduced any 3rd party dependency changes
  • I have performed a self-review of my code

… admin-cli authentication

- Upgrade Keycloak operator to 26.5.0 which natively supports bootstrap password initialization
- Migrate from custom system-client to built-in admin-cli for KTC authentication
- Add required OAuth scopes (openid, profile, email, roles, groups) to admin-cli client
- Fix KTC tenant controller init container to authenticate with admin-cli

This consolidates all Keycloak 26.x upgrade work including bootstrap password fixes and authentication client migration.
@sandeepbh5 sandeepbh5 force-pushed the bitnamilegacy-to-official-keycloak-02dec branch from e7a5618 to abf4d3c Compare January 7, 2026 13:12
…flow

- Changed system-client.publicClient from false back to true
- Public clients support Resource Owner Password Credentials (ROPC) grant without needing client secrets
- This allows password grant requests to work without invalid_client_credentials errors
- Changed back from system-client to admin-cli throughout codebase
- admin-cli is Keycloak's built-in client that works reliably
- Reverted: platform-keycloak.tpl, keycloak-tenant-controller.tpl
- Reverted: 8 test/tool scripts and mage config
- admin-cli with publicClient=true supports password grant natively
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants