keycloak · vmuzikar · Jun 29, 2026 · Mar 9, 2026 · Jun 4, 2026 · Jun 4, 2026
@@ -190,12 +190,10 @@ jobs:
       - name: Deploy an example Keycloak and wait for it to be ready
         working-directory: operator/scripts
         run: |
-          ./check-crd-installed.sh keycloaks.v2alpha1.k8s.keycloak.org
-          ./check-crd-installed.sh keycloakrealmimports.v2alpha1.k8s.keycloak.org
-          ./check-crd-installed.sh keycloaks.v2beta1.k8s.keycloak.org
-          ./check-crd-installed.sh keycloakrealmimports.v2beta1.k8s.keycloak.org
-          ./check-crd-installed.sh keycloakoidcclients.v2alpha1.k8s.keycloak.org
-          ./check-crd-installed.sh keycloaksamlclients.v2alpha1.k8s.keycloak.org
+          for file in ../target/kubernetes/*k8s.keycloak.org-v1.yml; do
+            name=$(basename "$file" -v1.yml)
+            ./check-crd-installed.sh ${name}
+          done
           ./deploy-examples.sh
 
       - name: Single namespace cleanup
@@ -244,6 +242,120 @@ jobs:
         with:
           name: oc-inspect
           path: inspect.*
+
+  test-kustomize:
+    name: Test kustomize installation
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set version
+        id: vars
+        run: echo "version_remote=0.0.1-${GITHUB_SHA::6}" >> $GITHUB_ENV
+
+      - name: Setup Java
+        uses: ./.github/actions/java-setup
+
+      - name: Restore Quarkus snapshot cache
+        if: github.ref == 'refs/heads/quarkus-next' || github.base_ref == 'quarkus-next'
+        uses: ./.github/actions/quarkus-snapshot-cache
+
+      - name: Setup Minikube-Kubernetes
+        uses: manusa/actions-setup-minikube@b65276017fdec6f1e6498129fb740e34e260dc55 # v2.18.0
+        with:
+          minikube version: ${{ env.MINIKUBE_VERSION }}
+          kubernetes version: ${{ env.KUBERNETES_VERSION }}
+          github token: ${{ secrets.GITHUB_TOKEN }}
+          driver: docker
+          start args: --memory=${{ env.MINIKUBE_MEMORY }} --addons=registry --insecure-registry=192.168.49.0/24
+
+      - name: Install OPM / OC
+        uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1.13.1
+        with:
+          # openshift-tools-installer is out-of-date for later opm, which started using the binary name opm-rhelX.
+          # we may have to do our own installation to move past this
+          opm: 4.16.4
+          oc: 4
+
+      - name: Download keycloak distribution
+        id: download-keycloak-dist
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: keycloak-dist
+          path: quarkus/container
+
+      - name: Build Keycloak Docker image
+        run: |
+          eval $(minikube -p minikube docker-env)
+          (cd quarkus/container && docker build --build-arg KEYCLOAK_DIST=$(ls keycloak-*.tar.gz) . -t keycloak:${{ env.version_remote }})
+
+      - name: Arrange kustomize test installation for own namespace
+        run: |
+          kubectl create ns keycloak-own
+
+          eval $(minikube -p minikube docker-env)
+          ./mvnw install -Poperator -pl :keycloak-operator -am \
+              -Dquarkus.container-image.build=true \
+              -Dquarkus.kubernetes.image-pull-policy=IfNotPresent \
+              -Dkc.operator.keycloak.image=keycloak:${{ env.version_remote }} \
+              -Dquarkus.kubernetes.env.vars.kc-operator-keycloak-image-pull-policy=Never \
+              --no-transfer-progress -DskipTests -Dkustomize.namespace=keycloak-own
+
+          kubectl apply -k operator/target/kubernetes
+
+      - name: Deploy an example Keycloak and wait for it to be ready
+        working-directory: operator/scripts
+        run: |
+          for file in ../target/kubernetes/*k8s.keycloak.org-v1.yml; do
+            name=$(basename "$file" -v1.yml)
+            ./check-crd-installed.sh ${name}
+          done
+          ./deploy-examples.sh keycloak-own
+          ./undeploy-examples.sh keycloak-own
+          kubectl delete ns keycloak-own
+
+      - name: Arrange kustomize test installation for all namespaces
+        run: |
+          kubectl create ns keycloak-operator
+
+          eval $(minikube -p minikube docker-env)
+          ./mvnw install -Poperator -Pcluster-wide -pl :keycloak-operator -am \
+              -Dquarkus.container-image.build=true \
+              -Dquarkus.kubernetes.image-pull-policy=IfNotPresent \
+              -Dkc.operator.keycloak.image=keycloak:${{ env.version_remote }} \
+              -Dquarkus.kubernetes.env.vars.kc-operator-keycloak-image-pull-policy=Never \
+              --no-transfer-progress -DskipTests
+
+          kubectl apply -k operator/target/kubernetes
+
+      - name: Deploy an example Keycloak and wait for it to be ready
+        working-directory: operator/scripts
+        run: |
+          for file in ../target/kubernetes/*k8s.keycloak.org-v1.yml; do
+            name=$(basename "$file" -v1.yml)
+            ./check-crd-installed.sh ${name}
+          done
+          kubectl create ns keycloak
+          ./deploy-examples.sh keycloak
+          ./undeploy-examples.sh keycloak
+
+      - name: Debug Custom Resources
+        if: failure()
+        run: |
+          kubectl get keycloaks -A -o yaml
+          kubectl get keycloakrealmimports -A -o yaml
+
+      - name: Gather inspect report
+        if: failure()
+        run: oc adm inspect ns
+
+      - name: Upload inspect report
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: oc-inspect
+          path: inspect.*
 
   check:
     name: Status Check - Keycloak Operator CI
@@ -254,6 +366,7 @@ jobs:
       - test-local-apiserver
       - test-remote
       - test-olm
+      - test-kustomize
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

@@ -100,33 +100,45 @@ After installation, any upgrade will require manual approval through the OLM int
 
 You can install the Operator on a vanilla Kubernetes cluster by using `kubectl` commands:
 
-. Install the CRDs by entering the following commands:
+. Install the {project_name} Operator in the `keycloak` namespace by executing the following commands:
 +
 [source,bash,subs="attributes+"]
 ----
-kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{version}/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
-kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{version}/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+kubectl create namespace keycloak
+kubectl apply -k 'github.com/keycloak/keycloak-k8s-resources/kubernetes?ref={version}'
 ----
 
-. Install the {project_name} Operator deployment in the `keycloak` namespace by executing the following commands:
-+
+The Operator will watch the namespace where it is installed.
+
+Preview support is available for installing the Operator cluster-wide when using `kubectl`.
+
+To install the Operator cluster-wide, use the `cluster-wide` kustomization:
+
 [source,bash,subs="attributes+"]
 ----
-kubectl create namespace keycloak
-kubectl -n keycloak apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{version}/kubernetes/kubernetes.yml
+kubectl create namespace keycloak-operator
+kubectl apply -k 'github.com/keycloak/keycloak-k8s-resources/cluster-wide?ref={version}'
 ----
 
-The Operator will watch the namespace where it is installed. You may utilise a different namespace with the `-n` option,
-however you must also update the `ClusterRoleBinding` subject. For example, to install in the namespace `custom-namespace`,
-execute the following commands:
+This installs the Operator into the `keycloak-operator` namespace and configures it to watch resources in all namespaces.
+
+To use a different installation namespace, create an overlay specifying either the kubernetes (own namespace) or cluster-wide install with the desired namespace:
 +
 [source,bash,subs="attributes+"]
 ----
 kubectl create namespace custom-namespace
-kubectl -n custom-namespace apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/{version}/kubernetes/kubernetes.yml
-kubectl patch clusterrolebinding keycloak-operator-clusterrole-binding --type='json' -p='[{"op": "replace", "path": "/subjects/0/namespace", "value":"custom-namespace"}]'
-# if you have existing keycloaks, restart the operator after patching the clusterrolebinding
-kubectl rollout restart -n custom-namespace Deployment/keycloak-operator
+
+cat <<EOF >./kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: custom-namespace
+
+resources:
+  - github.com/keycloak/keycloak-k8s-resources/kubernetes?ref={version}
+EOF
+
+kubectl apply -k ./
 ----
 </@profile.ifCommunity>
 

@@ -67,13 +67,7 @@ Install the CRD definition and the operator in the cluster in the `keycloak` nam
 
 ```bash
 kubectl create namespace keycloak
-kubectl apply -k target
-```
-
-to install in the `default` namespace:
-
-```bash
-kubectl apply -k overlays/default-namespace
+kubectl apply -k target/kubernetes
 ```
 
 Remove the created resources with:

@@ -22,6 +22,8 @@
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <quarkus.container-image.group>keycloak</quarkus.container-image.group>
         <quarkus.docker.build-args.KEYCLOAK_VERSION>${project.version}</quarkus.docker.build-args.KEYCLOAK_VERSION>
+        <quarkus.operator-sdk.generate-with-watched-namespaces>JOSDK_WATCH_CURRENT</quarkus.operator-sdk.generate-with-watched-namespaces>
+        <kustomize.namespace>keycloak</kustomize.namespace>
     </properties>
 
     <dependencyManagement>
@@ -198,7 +200,6 @@
             <plugin>
                 <groupId>io.quarkus</groupId>
                 <artifactId>quarkus-maven-plugin</artifactId>
-                <version>${quarkus.build.version}</version>
                 <extensions>true</extensions>
                 <executions>
                     <execution>
@@ -213,22 +214,55 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>list-crds</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>run</goal>
+                        </goals>
+                        <configuration>
+                            <target>
+                                <pathconvert pathsep="${line.separator}  - " property="crds">
+                                    <map from="${project.basedir}/target/kubernetes/" to=""/>
+                                    <sort>
+                                        <fileset dir="${project.basedir}/target/kubernetes">
+                                            <include name="*k8s.keycloak.org-v1.yml"/>
+                                        </fileset>
+                                    </sort>
+                                </pathconvert>
+                            </target>
+                            <exportAntProperties>true</exportAntProperties>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
             <plugin>
                 <artifactId>maven-resources-plugin</artifactId>
                 <executions>
                     <execution>
                         <id>copy-resources</id>
-                        <phase>validate</phase>
+                        <phase>package</phase>
                         <goals>
                             <goal>copy-resources</goal>
                         </goals>
                         <configuration>
                             <outputDirectory>${basedir}/target</outputDirectory>
                             <resources>
-                            <resource>
-                                <directory>src/main/kubernetes</directory>
-                                <filtering>true</filtering>
-                            </resource>
+                                <resource>
+                                    <directory>src/main</directory>
+                                    <filtering>true</filtering>
+                                    <excludes>
+                                        <exclude>kubernetes/kubernetes.yml</exclude>
+                                    </excludes>
+                                    <includes>
+                                        <include>kubernetes/**</include>
+                                    </includes>
+                             </resource>
                             </resources>
                         </configuration>
                     </execution>
@@ -352,5 +386,12 @@
                 <quarkus.profile>rhbk</quarkus.profile>
             </properties>
         </profile>
+        <profile>
+            <id>cluster-wide</id>
+            <properties>
+                <kustomize.namespace>keycloak-operator</kustomize.namespace>
+                <quarkus.operator-sdk.generate-with-watched-namespaces>JOSDK_ALL_NAMESPACES</quarkus.operator-sdk.generate-with-watched-namespaces>
+            </properties>
+        </profile>
     </profiles>
 </project>
@@ -1,9 +1,19 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-namespace: keycloak
+namespace: ${kustomize.namespace}
 
 resources:
-  - kubernetes/keycloaks.k8s.keycloak.org-v1.yml
-  - kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
-  - kubernetes/kubernetes.yml
+  - ${crds}
+  - kubernetes.yml
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+    setRoleBindingSubjects: allServiceAccounts
+    fieldSpecs:
+    - path: metadata/namespace
+      create: true
@@ -28,9 +28,6 @@ quarkus.kubernetes.resources.limits.cpu=700m
 quarkus.operator-sdk.bundle.package-name=keycloak-operator
 quarkus.operator-sdk.bundle.channels=fast
 
-quarkus.operator-sdk.namespaces=JOSDK_WATCH_CURRENT
-quarkus.operator-sdk.generate-with-watched-namespaces=JOSDK_WATCH_CURRENT
-
 quarkus.docker.additional-args=--ulimit,nofile=1024000
 
 quarkus.operator-sdk.crd.post-processor=org.keycloak.operator.MultiVersionCRDPostProcessor
@@ -17,7 +17,7 @@
 
 package org.keycloak.operator.testsuite.apiserver;
 
-import java.io.FileNotFoundException;
+import java.io.IOException;
 
 import org.keycloak.operator.crds.v2alpha1.client.KeycloakOIDCClient;
 import org.keycloak.operator.crds.v2alpha1.client.KeycloakOIDCClientBuilder;
@@ -50,7 +50,7 @@ public class CRDTest {
     static final ObjectMapper mapper = new ObjectMapper();
 
     @BeforeAll
-    public static void before() throws FileNotFoundException {
+    public static void before() throws IOException {
         BaseOperatorTest.createCRDs(client);
     }