Stéphane Tailland
eed8c3da3b
Every agent has to name this client in the audience scopes it requests, so the one thing an agent could not avoid naming was the very thing it should know nothing about. The gateway serving those URLs is replaceable; the contract should not imply otherwise. kong-token-exchange-broker becomes token-exchange-broker, same credential, same behaviour. The rename was rolled out in order — new client alongside the old, then the callers, then the gateways, then removal — so no call ever hit a realm that had forgotten the name its caller was still using. Followed through the client scope, the audience mappers, the fine-grained admin policy allow-broker-client, and the roles map. The Vault property keeps the old name. Renaming it there means re-issuing the value to every gateway holding a copy, for no gain; the ExternalSecret maps it to KC_SECRET_TOKEN_EXCHANGE_BROKER instead, so everything the cluster can see is neutral. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pm-keycloak
Keycloak deployment with declarative realm configuration via keycloak-config-cli.
Stack
- Keycloak 26.5.4 — identity and access management
- PostgreSQL 16 — persistent storage
- keycloak-config-cli 6.5.0 — declarative realm configuration
Installation
Prerequisites
- Docker and Docker Compose
Setup
cd compose
cp .env.example .env
Edit .env with your credentials:
COMPOSE_PROJECT_NAME=pm-keycloak
KC_DB_PASSWORD=<your-db-password>
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=<your-admin-password>
Start
docker compose up -d
Keycloak is available at http://localhost:8080.
keycloak-config-cli runs once at startup, applies all realm configuration files, then exits. This is expected behavior.
Configuration
Realm configuration files live in compose/keycloak-config/. Each .yaml file maps to one realm.
Apply configuration changes
After editing a realm file:
docker compose run --rm keycloak-config-cli
File structure
compose/keycloak-config/
├── master-realm.yaml # minimal patch of the master realm
└── demo-realm.yaml # example realm with roles and clients
Managed mode
IMPORT_MANAGED_REALM: full is set, meaning keycloak-config-cli is the source of truth for each realm it manages. Anything not declared in a YAML file will be removed from Keycloak on the next apply.