Repository navigation
Proper secrets support for identityProviders in KeyCloakRealm CRD #12947
hecsalazar
started this conversation in
Archive
Replies: 2 comments
|
We faces the same issue. Secret values of any kind in the CRD should be able to be retrieved from secrets resources. |
0 replies
|
We also have the same issue. Inside the KeycloakRealmImport Custom Resource the complete Keycloak configuration can be mapped. There should be a possibility referencing some values to existing secrets (for example client-secrets or Keystore passwords, which could be used for the Realm Keys etc.). Secrets do not belong directly in Git and therefore the GitOps approach cannot be implemented properly, because otherwise Secrets have to be pushed into Git. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
The KeyCloakRealm CRD specification for authentication providers often require to setup secrets to integrate to identity providers.
These secrets usually fall into the
configsection of the provider that currently is just a simple map.When deploying a Realm CRD those secrets are exposed in the CRD itself instead of being properly secured as a k8s secret.
Example: setting up Google as identity provider exposes in the the CRD the google credentials for the application which is a very sensitive secret.
This makes more challenging operating the CRD by basically preventing reads on it
All reactions