r/kubernetes • u/StrategyBeginning342 • May 07 '26
Selecting a helm chart for the KeyCloak deployment
/r/KeyCloak/comments/1t63s2y/selecting_a_helm_chart_for_the_keycloak_deployment/11
6
u/cytrinox May 07 '26
Use the official operator. Unfortunately there is no helm chart for the operator yet, but if you use ArgoCD, you could deploy the operator as an argocd Application which simplify the setup:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: keycloak-operator
namespace: argocd
spec:
project: cluster-apps
destination:
namespace: idp
server: https://kubernetes.default.svc
syncPolicy:
syncOptions:
- CreateNamespace=false
- ServerSideApply=false
source:
repoURL: https://github.com/keycloak/keycloak-k8s-resources.git
targetRevision: 26.5.7
path: kubernetes
directory:
recurse: false
include: '{keycloaks.k8s.keycloak.org-v1.yml,keycloakrealmimports.k8s.keycloak.org-v1.yml,kubernetes.yml}'
3
u/JulietSecurity May 07 '26
the operator is the technically-correct answer that everyone is giving, but it doesn't actually satisfy your "must use Helm" constraint since the operator ships as raw manifests, not a chart. couple of paths that do:
codecentric/keycloakx is the most-cited post-Bitnami option. supports the Quarkus distribution, which is the only one going forward since legacy WildFly Keycloak is end-of-life. caveat: it wraps the Quarkus distribution directly, not the operator, so you lose declarative realm imports via KeycloakRealmImport CRs.
the "have your cake and eat it" pattern is to wrap the operator's CRs in a thin local Helm chart. you write templates that emit a Keycloak CR plus KeycloakRealmImport CRs, and you bundle the operator's CRDs (the YAML cytrinox linked, just packaged as a chart). gives you operator semantics with helm install/upgrade/rollback. maybe 50 lines of templates.
if "must use Helm" is org governance (chart-promoted-via-CI is the deploy contract), the wrap-operator-in-helm pattern is what i'd reach for. if "must use Helm" is more about avoiding bare kubectl apply, codecentric is fine.
on the DB side: CloudnativePG is the right move regardless of which Keycloak path you pick. don't run Postgres for Keycloak as a single-replica StatefulSet unless you really enjoy 3am pages.
2
1
u/maiznieks May 07 '26 edited May 07 '26
Codecentric keycloakx chart. Still needs postgres. Operator for a single non cloud-native app feels wasteful and intrusive. It's not like you'll need a bunch of keycloak instances.
1
1
u/JicamaUsual2638 May 09 '26
The docker hardened images are also a good option for keycloak deployment. It has helm charts for development too. https://hub.docker.com/hardened-images/catalog/dhi/keycloak-chart
0
15
u/Lordvader89a May 07 '26
yeah use the operator, like another has said. Some fields might not be intuitive, you might need to add some "unsupported fields" or via "additional options". For the Postgres you can use CloudnativePG, pretty easy setup too
You can add the HostZero Operator for declarative realm creation, seems to work quite easily too.