Keycloak Configuration for Kubernetes Operator
Keycloak is the the default authentication manager for Release. This topic describes the steps involved in configuring Keycloak before and after the Release installation.
This guide is for administrators who install and manage Digital.ai Release.
- The Operator zip file is downloaded from the Release Software Distribution site and extracted to the Deploy server filesystem you would use to install Release on the Kubernetes cluster.
- A local Deploy instance installed on your system. For information about how to set up local Deploy instance, see platform specific Operator-based installation instructions.
To configure Keycloak as the default authentication manager for Digital.ai Release, go to
digitalai-release/kubernetes folder of the Operator file and update the OIDC parameters in the
To enable external OIDC configuration on Digital.ai Release:
- Set the
Note: By default, this value is set to
true. If you want to use a different authentication provider other than Keycloak, set the value to
Configure the values for the OIDC parameters in the
dairelease_cr.yamlfile as described in the following table:
Note: For more information about OIDC configuration, see Release OIDC with Keycloak.
|oidc.external||Is external configuration enabled||true|
|oidc.clientid||Client credentials from Release to Keycloak||clientId = ”
|oidc.userNameClaimName||User property mappings||userNameClaimName = “preferred_username” fullNameClaim = “name” emailClaim = “email” rolesClaim = “groups”|
|oidc.issuer||URLs from Browser to Keycloak||issuer =
|oidc.redirectUri||URLs from Browser to Release||redirectUri =
|oidc.keyRetrievalUri||URLs from Release to Keycloak||keyRetrievalUri =
|oidc.scopes||List of scopes (note single quotes around list, same way as in example)||’[“openid”]’|
Note: The path-based routing will not work if you use OIDC authentication. To enable path-based routing, you must modify the
ingress specification in the
dairelease_cr.yaml file as follows:
ingress.path: /xl-release(/|$)(.*)to /
Note: if you have some missing values above, use "" for that value in the oidc object. Do not delete that value from the object.
To configure Keycloak as the default authentication manager for Digital.ai Release, specify the values for the OIDC parameters in the the
dairelease_cr.yaml as described in the following table:
- By default, Kubernetes Operator installer uses embedded Postgres database for Keycloak authentication.
- For more information about keycloak authentication with External Database, see “Operator Based Solution with keycloak enabled with external database”
|keycloak.ingress.rules.host||Defines the valid DNS name for the Keycloak Ingress resource. This is a mandatory parameter.
Note: By default, Keycloak pod uses the Postgres database that is included in the Operator installer. If you want to use an external database, create a database and a user, and ensure to update the parameters described in this table in the Keycloak section.
|DB_VENDOR||Defines the database vendor name. This is a mandatory parameter.||NA|
|DB_ADDR||Defines the database URI. This is a mandatory parameter.||NA|
|DB_PORT||Defines the port number. This is a mandatory parameter.||NA|
|DB_USER||Defines the username of the database user. This is a mandatory parameter.||NA|
|DB_PASSWORD||Defines the password of the database user. This is a mandatory parameter.||NA|
|spec.keycloak.install||Installs the Keycloak chart.||true|
|Defines the username of the Keycloak user.||admin|
|Defines the password of the Keycloak user.||admin|
Note: This is not an officially supported use case. Use these instructions at your own discretion.
Use the following instructions to set up an existing Keycloak database, if you have been using an existing PostgreSQL database for Keycloak and if you want to use it while installing or upgrading Release using the Operator-based installer.
Operator-based Fresh Installation
dairelease_cr.yamlfile for setting up Keycloak with external database.
- If you are using external database for both Release and Keycloak, update the values for the following parameters:
- If you are using external database only for Keycloak and embedded Postgres database for Release, update the values for the following parameters:
- During the upgrade process, you need to use the
custom operator zipoption for setting up Keycloak with external database.
Answer the following question while upgrading.
Do you want to use custom operator zip file for Release?Yes
? Release operator zip to use (absolute path or URL to the zip)
- Download the operator zip from the Release Software Distribution site.
- Extract the ZIP file to the ReleaseInstallation folder.
Update the following in
dairelease_cr.yamlfor setting up Keycloak with external database.
.spec.keycloak.extraENVupdate the following fields.
- Zip the operator package and provide absolute path of the zip while upgrading [? Release operator zip to use (absolute path or URL to the zip)].
If External database for Release is used, then during upgrade process we need to edit list of following question Edit list of custom resource keys that will migrate to the new Release CR and update the following parameters`.
- During the upgrade process, you need to use the
As an admin, you can add user roles, assign role-based permissions, and configure Keycloak users with the required user roles.
To add user roles:
- Log in to Digital.ai Release as admin, or a user with the Admin global permission.
- From Release GUI, click User Management > Roles > Add Role, and type the role. For example
- Click Save.
To assign global permissions to the user role:
From Release GUI, click User Management > Global Permissions, and select the checkboxes next to the user role (for example,
oidc-administrators) to define the required permissions for the selected user role.
After assigning global permissions to the user role, to configure Keycloak users with this user role:
- Log in to Keycloak as admin.
- In the navigation pane, under Manage, click Users and select the user, for example —
From the Role Mapping tab, choose the role under Assigned Roles.
Note: For information about the role, click Roles under Configure group.
After configuring the parameters, you can verify the OIDC authentication by accessing the Release application.
In a web browser, enter the URL of the Release application. You will be redirected to the Keycloak Login screen.
If configured, enter the username and password for Release, or enter the default username and password (
Note: After the successful configuration of Keycloak OIDC authentication, the default login credentials (
admin/admin) will no longer work.
After a successful authentication, you will be redirected to the Release dashboard.
- By default, the Operator comes with the default realm —
digitalai-platform. You can use this realm to configure users and identity providers for Digital.ai products, such as Release and Deploy.
- To sign in as
oidc-user, you can use the login credentials of any of the following sample users:
- If you want to sign in as an internal user, browse directly to