Operator is not synchronizing realm changes to Keycloak about keycloak-operator

[apeschel]

Keycloak Operator uses a one-way sync for Realms, Clients and Users. The one way sync has been implemented on purpose. Without this approach, any change made manually in the Admin UI would be overridden.

I see having declarative configuration overriding manual changes made through the UI as an absolute win.

[vmuzikar]

This is actually not a bug. Realm's are just created, not updated based on the changes in the CR. It is by design as it's very error prone to do the updates correctly.

Obviously, the bug here is the docs stating that Realms can be updated. This needs to be fixed.

[rtrive]

@vmuzikar I think the operator needs to allow updates. For example: if I want to update the access token's duration do I need to delete and recreate the realm?
@christianviana I will also add accessTokenLifespanas a parameter that is not updated by the operator

[vmuzikar]

@rtrive It is really by design. Realms can't be updated using the operator. We plan to take a little bit different approach with the new operator with the static configuration.

The docs will be updated as part of keycloak/keycloak-documentation#1402. After it is merged, we can close this issue.

[neuromantik33]

I know this has been discussed over and over, but not being able to reconcile realm info makes the operator almost unusable when assigning realm roles and groups. I'm not sure how this operator is better than an helm chart, even clients can't be reconciled. I think the way grafana handles datasources and the such can be an inspiration, ie. certain resources (data sources, dashboards) are either injected as config maps and are immutable from the UI, or anything can be created with the UI but isn't managed by the operator.

[apapia]

I concur with @neuromantik33. However, I have been able to reconcile clients, just not realms.

[neuromantik33]

I'll just add that if ansible is able to reconcile realm state I don't see why the operator can't do the same. As is ansible philosophy, if it isn't managed by ansible the latter does to any unmanaged resources.

[vmuzikar]

Closing this as it is by design and proper documentation was added in keycloak/keycloak-documentation#1402.