KeycloakUser
keycloak.hostzero.com / v1beta1
apiVersion: keycloak.hostzero.com/v1beta1
kind: KeycloakUser
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
KeycloakUserSpec defines the desired state of KeycloakUser
clientRef object
ClientRef is a reference to a KeycloakClient for service account users
One of realmRef, clusterRealmRef, or clientRef must be specified
Use this to manage the service account user associated with a client
name
string required
Name of the resource
clientRoles
object
ClientRoles maps a client's clientId to the authoritative set of
client-level role names for this user. When omitted, client roles are not
managed; when set, roles on clients absent from the map are removed.
Do not combine with KeycloakRoleMapping resources targeting the same user.
clusterRealmRef object
ClusterRealmRef is a reference to a ClusterKeycloakRealm
One of realmRef, clusterRealmRef, or clientRef must be specified
Use this for regular realm users with cluster-scoped realms
name
string required
Name of the cluster-scoped resource
definition
object
Definition contains the Keycloak UserRepresentation. Set the username via
spec.username; role and group assignments go in spec.realmRoles,
spec.clientRoles, and spec.groups.
groups
[]string
Groups is the authoritative set of group names this user belongs to,
reconciled via the Keycloak group-membership endpoints. When omitted,
group memberships are not managed; an empty list removes all memberships.
initialPassword object
InitialPassword sets the initial password for the user (only on creation).
For managed credentials stored in a Kubernetes secret, use KeycloakUserCredential.
temporary
boolean
Temporary indicates if the user must change password on first login
value
string required
Value is the password value
realmRef object
RealmRef is a reference to a KeycloakRealm
One of realmRef, clusterRealmRef, or clientRef must be specified
Use this for regular realm users
name
string required
Name of the resource
realmRoles
[]string
RealmRoles is the authoritative set of realm-level role names for this
user, reconciled via the Keycloak role-mapping endpoints. When omitted,
realm roles are not managed; an empty list removes all realm roles.
Pointer types so an explicit empty value survives JSON round-trips.
Do not combine with KeycloakRoleMapping resources targeting the same user.
username
string
Username is the username in Keycloak. Required for regular realm users;
omit it for service account users, which are identified by clientRef and
whose username is derived by Keycloak. Immutable once set.
minLength:
1status object
KeycloakUserStatus defines the observed state of KeycloakUser
clientID
string
ClientID is the client UUID if this is a service account user
conditions []object
Conditions represent the latest available observations
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316instance object
Instance contains the resolved instance reference
clusterInstanceRef
string
ClusterInstanceRef is the name of the cluster instance
instanceRef
string
InstanceRef is the name of the namespaced instance
isServiceAccount
boolean
IsServiceAccount indicates if this user is a service account for a client
message
string
Message contains additional information
observedGeneration
integer
ObservedGeneration is the generation of the spec that was last processed
format:
int64
ready
boolean required
Ready indicates if the user is ready
realm object
Realm contains the resolved realm reference
clusterRealmRef
string
ClusterRealmRef is the name of the cluster realm
realmRef
string
RealmRef is the name of the namespaced realm
resourcePath
string
ResourcePath is the Keycloak API path for this user
status
string
Status is a human-readable status message
userID
string
UserID is the Keycloak internal user ID
username
string
Username is the resolved username in Keycloak
No matches. Try .spec.clientRef for an exact path