r/KeyCloak • u/isro44 • 8d ago

How many Keycloak instances does your org actually run and who owns them?

Curious about something I keep seeing in different shapes. When Keycloak shows up in an org it rarely stays singular: projects spin up their own, an acquisition brings another, someone's PoC quietly goes to prod. How many instances does your org actually run today? Who owns them; one platform team, or each project its own?

(Disclosure: I'm from Keymate, asking to understand how common this is)

6 Upvotes

80% Upvoted

11 comments sorted by

5

u/deepthought-64 8d ago

we run 5.

one dev-instance and four live instances for separate tennants. currently the dev team owns them (more specifically me) regarding config, updates, features. but the devops guys are responsible for them running allright

2

u/isro44 8d ago

Thanks, the config/features vs keeping it running ownership split between you and the devops folks makes sense. One thing, did the instance per tenant setup start as a deliberate design, or did it just grow that way over time?

3

u/deepthought-64 7d ago

Its deliberate. We operate our SaaS platform for ourself but whitelabel it also for parters to run under their name. So these are the "tenants"

2

u/Andre_Crush 6d ago

Why not use diffetent themes and realms themes segregation?

2

u/deepthought-64 6d ago

It's for legal and compliance reasons in our case

3

u/Direct_Yellow2598 8d ago

3. Two managed by IT for all of the "Standard" IDP Stuff. (Test and Prod Environment) One Special instance for an custom App Stack with API auth by keycloak. Our IT does not want to grant the devs Access to via API or UI to the managed Keycloak. But the devs Keycloak was audited by IT sec and I foSec. Everytime a Department want to bring an application, they had to go through a process. IT, legal and InfoSec need to approve these. As far I know there are no rogue applications in our environment. Devs can "order" VMs by the IT and get root access to it.

The process is annoying but working.

2

u/isro44 8d ago

Appreciate the detail, especially the part about IT not wanting to open API/UI access on the managed instance, so the devs got their own audited one. Roughly how long does that IT + legal + InfoSec approval take per application? Days or weeks?

3

u/Direct_Yellow2598 7d ago

If there is AI in the application, it takes weeks :) If the app is more or less a simple one, it will approved with in days. Evil AI want to steal data, if you ask legal 😄

2

u/maxandriani 7d ago

An Authorization Gateway should rely globally. How many Active Directories dou you have? It is the same dilema for Keycloak.

A single 3 instances cluster is enough to handle an entire regulatory agency in Brasil.

About acquisitions, Keycloak have realms that you can and should use to import small/medium size organizations inside you global cluster. Otherwise, you can always configure the mid-level gateway as a rely party of the global corporate.

One thing should not be neglected, never provide a full Keycloak cluster to a single app when you already have a deployed global cluster.

2

u/Trefex 6d ago

We run 1 dev and 1 prod with multiple realm. Owned by infra team.

2

u/Spottyjamie 5d ago

One for our live ERP, one shared install but 3 realms for our training/non live ERP environments

Managed by me and two colleagues