Skip to content

Prevent creation of an IDP resource that would lead to an already existing Keycloak realm #286

@nexus49

Description

@nexus49

Context

Currently it is possible to apply 2 IDP resources in different workspaces with the same name. This could lead to a situation that a realm is managed by 2 resources and could also allow deletion/takeover of another realm

Target

  • Add validating webhook to prevent creation of such IDP resource to mitigate this scenario
  • The webhook should check in Keycloak if the realm already exists and if it does it should reject creation
  • The above webhook behavior should also prevent a IDP resource for the master realm

This webhook can be inspired by the validatingwebhook of the account-operator. Also make sure to implement the necessary changes to the chart for the webhook to function again taking inspiration from the account-operator chart

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Status

Blocked/Waiting

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions