cybrix12

Thank you very much. I shared it with the team for a lookup.

Does it mean that a single user can be bound to more then one User Federation/Identity Provider?

Can you provide more detail on how you've done this?

What would be the suggested way to automate resources creation?

I use various home made Ansible roles and I find the Keycloak API to be inconsistent.

Eg: Various GET methods that doesn't return complete payload and some endpoints that doesn't save on POST but they do when updating.

That said, it's very hard to keep an idempotency with the actual state of the API.

I haven't yet tested the keycloak-operator [1].

[1]: https://github.com/keycloak/keycloak-operator

May I know how many replicas and CACHE_OWNERS do you have?

It looks like Quarkus is going to be considered for one of the next major release [1].

That said, do you believe it will still be possible to extend Keycloak using the deployment-scanner?

Also, do you happen to have open-source code related to Keycloak and/or custom extensions?

Beside the poor doc, finding more open-source code is one of the best way to learn this.

[1]: https://issues.redhat.com/browse/KEYCLOAK-13068?jql=project%...

When using a K8s cluster with the helm chart [1], it's actually the stateful set that takes care to the update.

When the first replica restart, Keycloak makes the updates to the database itself. Sometimes rolling back to a previous version can break. They do not hold the reverse of the database version [2].

I believe the reason behind the STS (StatefulSet) is so the cache have the time to spread among the replicas as it get upgraded.

[1]: https://github.com/codecentric/helm-charts/tree/master/chart... [2]: https://www.keycloak.org/docs/9.0/upgrading/

Cool list but I would like to see them being implemented using FP approach when possible.