KeycloakClient Secret

Getting advice
1

What is the recommended way to safely CI/CD KeycloakClient objects?

You shouldn’t put secrets in non Kubernetes Secret objects. The ‘secret’ property of the CRD is not safe as it refers to the plaintext secret, not a Kubernetes secret containing the actual secret.

It also doesn’t work to variable substitute into the vault with that property.

If you don’t specify it in the CR, it seems to randomly generate a new secret. Which is not so useful for reproducibility.

Precreating the Kubernetes secret that keycloak-operator generates doesn’t seem to work. It gets overwritten.

There a trick I’m missing?

Thanks,
Kevin

2 Likes
2

One option would be to update the KeycloakClient to allow users to specify the source to read the ‘secret’ from, similar to how the k8s Pod allows setting environment variable from a value in a k8s Secret.

e.g.

client:
  clientId: my-client
  secretValueFrom:
    secretKeyRef:
      name: mysecret
      key: mysecretkey
1 Like