Ability to deploy several keycloaks per namespace

[desaintmartin]

Description

In order to ease maintenance, it would be great to have the ability to customize naming of resources created by the operator in order to have several Keycloak installations in the same namespace.

Today, ApplicaitonName is hardcoded:

keycloak-operator/pkg/model/constants.go

Line 5 in 77d1261

ApplicationName = "keycloak"

Discussion

No response

Motivation

No response

Details

No response

[andreaTP]

Hi @desaintmartin ,

thanks for rising this question! I see that what you are asking is desirable but would require also a different approach for the rest of the CRDs (e.g. Realm, Users , etc.).

Can you elaborate on your specific use-case? Do you have specific limitations on namespaces creation? What's your environment?

Thanks in advance!

[desaintmartin]

Sure! I understand it would require a lot of work, so let me give my use case:

• We need to deploy N keycloak instances on a given Kubernetes cluster
• Setting up RBACs to give needed permissions for keycloak operator on a namespace is a centralized action (actually, another Chart, but that's outside of the scope) managed by a Platform team but we still would like to control all RBACs
• Having a single namespace for all keycloaks:
  • would allow a simple permissions management & audit process
  • Would allow decentralized deployment by Software Engineering teams

[andreaTP]

N keycloak instances

Are the keycloak instances configured differently?

Regarding the mentioned advantages:

• would allow a simple permissions management & audit process
• Would allow decentralized deployment by Software Engineering teams

There are multiple ways for achieving the same without enclosing all the Keycloak instances into one namespace, e.g. simply adding specific labels; have you tried evaluated alternative approaches?

All in all, at this point we are focusing on the development of a new operator for Keycloak, this is unlikely to happen in this repo unless a compelling use-case pops-up and/or we have a community contribution.

I encourage you to take a look at the design document and follow the development in the main keycloak/keycloak repo.

[andreaTP]

As this issue has been around for a long time we are closing this issue as out of date. If the issue is still valid, feel free to reopen and provide details to why it is still valid.