keycloak-advanced

Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort. The Keycloak Advanced Helm chart automates deployment and configuration of Keycloak in Kubernetes clusters using Minimus images with hardened security and production-grade configuration.

Prerequisites

A subscription to the Minimus images included in the chart
A running Kubernetes cluster (v1.21 or higher is recommended)
kubectl installed and configured
Helm v3.8 or higher for OCI support (Installation instructions)
Cluster Admin privileges
Persistent storage available in your cluster
An administrator password (set via keycloak.auth.adminPassword in your values.yaml)
A Kubernetes Secret named keycloak-db-credentials in the release namespace containing keys password (for the keycloak DB user) and postgres-password (for the postgres admin user)

Note: This chart ships PostgreSQL Advanced as a sub-chart (default-enabled) with a stable service name (keycloak-postgres). Both Keycloak and PostgreSQL read their DB credentials from the keycloak-db-credentials Secret above — create it before running helm install. See the Keycloak configuration docs for the full option set.

Try It Out

In this example we will deploy Keycloak on a Kubernetes cluster using the Minimus Keycloak Advanced Helm chart. Keycloak will be configured with hardened security settings and production-grade defaults.

Step 1: Start Cluster

If you have a cluster to work with, skip this step. Otherwise, start a Minikube cluster. Deployment instructions

Step 2: Create Namespace

Create a namespace:

kubectl create ns keycloak-advanced

Then create the database credentials Secret used by both Keycloak and the bundled PostgreSQL Advanced sub-chart:

kubectl create secret generic keycloak-db-credentials \
    --from-literal=password="$(openssl rand -base64 24)" \
    --from-literal=postgres-password="$(openssl rand -base64 24)" \
    --namespace=keycloak-advanced

Step 3: Deploy the Helm Chart

Deploy the Minimus Helm chart:

helm install my-keycloak-advanced oci://helm.mini.dev/keycloak-advanced \
  --version 25.2.0 \
  -n keycloak-advanced \
  --wait

If you want to override the chart's defaults, go to the Values tab, save a copy locally with your changes. Deploy the chart with your overrides using -f values.yaml:

helm install my-keycloak-advanced oci://helm.mini.dev/keycloak-advanced \
  --version 25.2.0 \
  -f values.yaml \
  -n keycloak-advanced \
  --wait

Step 4: Verify Keycloak Advanced is Running

Check the pod status:

kubectl get pods -n keycloak-advanced -l app.kubernetes.io/name=keycloak

You should see output similar to:

NAME                                READY   STATUS    RESTARTS   AGE
my-keycloak-advanced-xxxxxxxxx-xxxxx   1/1     Running   0          2m

Step 5: Test HTTP Endpoint

Port-forward to the Keycloak service:

kubectl port-forward svc/my-keycloak-advanced 8080:80 -n keycloak-advanced

In another terminal, hit the master realm endpoint:

curl -sf http://localhost:8080/realms/master

You should receive a JSON payload describing the master realm.

Step 6: Clean Up

Uninstall the chart and delete the namespace to remove all resources:

helm uninstall my-keycloak-advanced -n keycloak-advanced
kubectl delete namespace keycloak-advanced

Terms & Info

Trademark

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Disclaimer

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.