KeycloakIdentityProvider

keycloak.hostzero.com / v1beta1

apiVersion: keycloak.hostzero.com/v1beta1 kind: KeycloakIdentityProvider metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

KeycloakIdentityProviderSpec defines the desired state of KeycloakIdentityProvider

alias string required

Alias is the identity provider alias in Keycloak. Immutable once set.

minLength: 1

clusterRealmRef object

ClusterRealmRef is a reference to a ClusterKeycloakRealm One of realmRef or clusterRealmRef must be specified

name string required

Name of the cluster-scoped resource

configSecretRef object

ConfigSecretRef is a reference to a Kubernetes Secret whose data entries are merged into definition.config before syncing to Keycloak. This allows sensitive configuration values (e.g. clientId, clientSecret) to be stored in a Secret rather than in plaintext in the CR. Secret values take precedence over values specified inline in definition.config.

name string required

Name of the Kubernetes Secret in the same namespace as the CR

definition object required

Definition contains the Keycloak IdentityProviderRepresentation. Set the alias via spec.alias.

organizationRef object

OrganizationRef references a KeycloakOrganization in the same namespace. The organization's status.organizationID is injected as organizationId on the identity provider. Requires Keycloak 26 or later. Do not set organizationId in definition; use this field instead.

name string required

Name of the resource

realmRef object

RealmRef is a reference to a KeycloakRealm One of realmRef or clusterRealmRef must be specified

name string required

Name of the resource

tokenExchange object

TokenExchange configures fine-grained-authz so that exactly the listed clients (and no others) may exchange tokens with this IdP as `subject_issuer`. Omit the field to leave token-exchange permissions unmanaged (whatever was clicked manually stays). Set to a list (possibly empty) to have the operator enable IdP permissions and bind a Client-type policy listing the allowed clients on the `token-exchange` scope permission in the realm-management authz resource server.

allowedClients []string required

AllowedClients is the list of clientIds (text, not UUIDs) in the same realm as the IdP that are permitted to perform token-exchange against this IdP. An empty list creates a policy that matches no clients, effectively denying all (useful as an explicit lockdown). Omitting the parent `tokenExchange` field entirely leaves Keycloak permissions untouched.

status object

KeycloakIdentityProviderStatus defines the observed state of KeycloakIdentityProvider

alias string

Alias is the resolved identity provider alias in Keycloak

conditions []object

Conditions represent the latest available observations

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

instance object

Instance contains the resolved instance reference

clusterInstanceRef string

ClusterInstanceRef is the name of the cluster instance

instanceRef string

InstanceRef is the name of the namespaced instance

lastAppliedDefinitionHash string

LastAppliedDefinitionHash is a hash of the last successfully applied definition (after secret merging). Keycloak masks config.clientSecret on read, so this is the only way to detect that the desired secret changed and must be pushed.

message string

Message contains additional information

organizationID string

OrganizationID is the resolved Keycloak organization ID when spec.organizationRef is set.

ready boolean required

Ready indicates if the identity provider is ready

realm object

Realm contains the resolved realm reference

clusterRealmRef string

ClusterRealmRef is the name of the cluster realm

realmRef string

RealmRef is the name of the namespaced realm

resourcePath string

ResourcePath is the Keycloak API path for this identity provider

status string

Status is a human-readable status message

tokenExchange object

TokenExchange contains the observed state of the token-exchange permission wiring, populated only when spec.tokenExchange is set.

enabled boolean

Enabled reflects whether fine-grained authz permissions are enabled on this IdP in Keycloak.

message string

Message carries the last token-exchange reconcile error, if any. Set only when token-exchange reconcile fails — the parent `status.ready` still reflects the IdP itself, not the TE side.

permissionID string

PermissionID is the ID of the `token-exchange` scope permission auto- created in the realm-management authz resource server when permissions are enabled on this IdP.

policyID string

PolicyID is the ID of the Client-type authz policy managed by the operator (carries the AllowedClients list).

policyName string

PolicyName is the name of the managed policy, useful for admins looking the resource up in the Keycloak UI.

No matches. Try .spec.alias for an exact path