Skip to content

prevent creation of an IDP resource that would lead to an already existing Keycloak realm#318

Open
makdeniss wants to merge 11 commits intomainfrom
feat/prevent-creation-idp
Open

prevent creation of an IDP resource that would lead to an already existing Keycloak realm#318
makdeniss wants to merge 11 commits intomainfrom
feat/prevent-creation-idp

Conversation

@makdeniss
Copy link
Contributor

@makdeniss makdeniss commented Feb 3, 2026

Add a validating admission webhook to block creation of IdentityProviderConfiguration resources when the corresponding Keycloak realm already exists (and always block master), preventing cross-workspace realm takeover/conflicts.

Changes Log

  • Added IdentityProviderConfiguration validating webhook (controller-runtime managed webhook builder) that denies CREATE for realm master and for realms that already exist in Keycloak (fail-closed on Keycloak check errors).
  • Extended Keycloak admin client to support the webhook’s realm-existence check.
  • Wired webhook server/config into the operator.

@makdeniss makdeniss self-assigned this Feb 3, 2026
@makdeniss makdeniss added the enhancement New feature or request label Feb 3, 2026
@makdeniss makdeniss requested a review from OlegErshov February 3, 2026 15:46
@makdeniss makdeniss moved this to In Progress in OpenMesh - Backlog Feb 3, 2026
@makdeniss makdeniss changed the title feat: prevent creation of an IDP resource that would lead to an already existing Keycloak realm prevent creation of an IDP resource that would lead to an already existing Keycloak realm Feb 4, 2026
@makdeniss makdeniss marked this pull request as ready for review February 6, 2026 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request feature

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

3 participants