Setup dedicated access for admins and regular users #39745

cmonty14 · 2025-05-15T09:14:01Z

cmonty14
May 15, 2025

Hello,
I have deployed successfully Keycloak using helm chart _bitnami/keycloak. In my K8s cluster I use Istio gateway as ingress controller.
This works using virtualService manifest:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: keycloak
  namespace: keycloak
spec:
  hosts:
    - "keycloak.sle-stage.devsys.net"  # Match the host in your Gateway
  gateways:
    - istio-system/sle-stage-gateway  # Reference your Gateway
  http:
    - match:
        - uri:
            prefix: "/"  # For keycloak.sle-stage.devsys.net, match all paths and port 80
      route:
        - destination:
            host: keycloak
            port:
              number: 80

Here's my current Keycloak configuration:

keycloak@keycloak-0:/$ kc.sh show-config
Appending additional Java properties to JAVA_OPTS
Current Mode: development
Current Configuration:
        kc.health-enabled =  false (keycloak.conf)
        kc.cache-stack =  kubernetes (keycloak.conf)
        kc.db-username =  keycloak (keycloak.conf)
        kc.spi-admin-realm =  master (ENV)
        kc.spi-theme-static-max-age =  -1 (classpath application.properties)
        kc.spi-theme-cache-themes =  false (classpath application.properties)
        kc.log-level-org.infinispan.transaction.lookup.JBossStandaloneJTAManagerLookup =  WARN (classpath application.properties)
        kc.log-level-io.quarkus.config =  off (classpath application.properties)
        kc.log-console-output =  default (keycloak.conf)
        kc.hostname-strict =  false (keycloak.conf)
        kc.http-management-relative-path =  / (Persisted)
        kc.https-port =  8443 (keycloak.conf)
        kc.metrics-enabled =  false (keycloak.conf)
        kc.proxy-forwarded-host =  xforwarded (keycloak.conf)
        kc.bootstrap-admin-username =   (ENV)
        kc.db =  postgres (keycloak.conf)
        kc.db-password =  ******* (keycloak.conf)
        kc.proxy-allow-forwarded-header =  xforwarded (keycloak.conf)
        kc.log-level-io.quarkus.hibernate.orm.deployment.HibernateOrmProcessor =  warn (classpath application.properties)
        kc.version =  26.2.4 (SysPropConfigSource)
        kc.db-url =  jdbc:postgresql://keycloak-postgresql:5432/keycloakdb?currentSchema=public (keycloak.conf)
        kc.http-relative-path =  / (keycloak.conf)
        kc.http-enabled =  true (keycloak.conf)
        kc.proxy-trusted-header-enabled =  xforwarded (keycloak.conf)
        kc.proxy-headers =  xforwarded (keycloak.conf)
        kc.log-level-org.jboss.resteasy.resteasy_jaxrs.i18n =  WARN (classpath application.properties)
        kc.log-level-io.quarkus.arc.processor.BeanArchives =  off (classpath application.properties)
        kc.cache =  ispn (keycloak.conf)
        kc.log-level-io.quarkus.deployment.steps.ReflectiveHierarchyStep =  error (classpath application.properties)
        kc.spi-theme-cache-templates =  false (classpath application.properties)
        kc.http-port =  8080 (keycloak.conf)
        kc.bootstrap-admin-password-file =  /opt/bitnami/keycloak/secrets/admin-password (ENV)
        kc.proxy-allow-x-forwarded-header =  xforwarded (keycloak.conf)
        kc.log-level =  DEBUG (keycloak.conf)
        kc.provider.file.keycloak-metrics-spi-7.0.0.jar.last-modified =  1747232872392 (Persisted)
        kc.log-level-io.quarkus.arc.processor.IndexClassLookupUtils =  off (classpath application.properties)
        kc.log-level-org.hibernate.engine.jdbc.spi.SqlExceptionHelper =  off (classpath application.properties)

Now I want to enhance this setup by separating admin users and regular users. This means only admin users can access master realm with administrative permissions.
My idea is to use two different URLs:
keycloak.sle-stage.devsys.net
keycloak-admin.sle-stage.devsys.net

Could you please advise how to proceed?

THX

Navigation Menu

Repository navigation

Setup dedicated access for admins and regular users #39745

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Setup dedicated access for admins and regular users #39745

Uh oh!

cmonty14 May 15, 2025

Replies: 0 comments

cmonty14
May 15, 2025