Identity and access in Platform Base

Platform Base runs Keycloak as the identity provider for the platform. Argo CD and Grafana sign users in through it. Keycloak itself can in turn sign users in through your own identity provider.

Keycloak is configured from Git

Keycloak runs as a Keycloak resource named keycloak in the iam namespace, served at iam.<baseDomain>. It does not keep its state in a database: the resource uses the dev-file database vendor. After a restart, the operators described below apply the configuration from Git again. Anything you create or change in the Keycloak UI or API is lost at the next restart. Make changes through Platform Base instead.

Two operators work together:

• The Keycloak operator (keycloak-operator Application) runs the Keycloak server from the Keycloak resource.
• The EDP Keycloak operator (keycloak-operator-edp Application) manages what is inside Keycloak, such as realms, clients and identity providers, from Kubernetes resources. It reconciles Keycloak instances in the whole cluster and reaches Keycloak at keycloak-service.iam through a ClusterKeycloak resource that uses the keycloak-initial-admin Secret.

Realms

There are two realms, both managed as ClusterKeycloakRealm resources:

• platform is for all platform applications, such as Argo CD and Grafana.
• master is Keycloak's own built-in realm. Platform Base adopts it so that you can configure it through Git too.

Single sign-on for Argo CD and Grafana

Each of Argo CD and Grafana has an OpenID Connect client in the platform realm, created from a KeycloakClient resource. The operator stores the client secret in a Secret that the application reads, so no secret is part of your configuration. Both clients get a groups claim, which Keycloak builds from the user attribute groups.

Argo CD reads groups and applies its own RBAC. A user who signs in through Keycloak gets the role role:readonly unless a policy grants more. You write the policies and the bindings of groups to roles in argocd.rbac.

Grafana derives the role of a user from the roles claim:

Role in the claim	Grafana role
grafana-admin	Grafana Admin
admin	Admin
editor	Editor
anything else	Viewer

The rules are JMESPath expressions in grafana.sso.rbac. By default every user who can sign in is at least a Viewer.

Identity providers

To let people sign in with an existing account, you add an OpenID Connect identity provider to the platform or master realm. The EDP operator creates it in Keycloak. Its client secret reaches Keycloak as a file, which Keycloak reads through its file vault, so the secret never appears in the Keycloak configuration. Either you reference a Secret that exists in the iam namespace, or Platform Base creates the Secret from a value you pass. See Add an identity provider for the configuration.