Keycloak proposal for submission to CNCF

[bdaw]

Keycloak submitted to CNCF in 2018 although has been impacted by process changes and halt of intake of new projects. This to certain extend derailed previous submission.

Creating a new PR instead of reopening old one as template changed.

Quickest way to learn about the project:

• Keycloak Pitch [1m 42s]: https://www.youtube.com/watch?v=GZTN_VXjoQw
• Keycloak Introduction [32min 11s]: https://www.youtube.com/watch?v=duawSV69LDI

What is worth highlighting in relation to previous discussions:

• Governance model: https://github.com/keycloak/keycloak/blob/master/GOVERNANCE.md
• Getting Started: https://www.keycloak.org/getting-started

Old closed PR: #176

[bdaw]

SIG Security Assesment Request: cncf/tag-security#372

[amye]

Welcome back! Is this for sandbox or incubation?

[bdaw]

@amye it is Sandbox.

I believe it is a matured enough project to match Incubation. Although from past experience would prefer to avoid this aspect derailing the discussion and create doubts on criteria to apply. Although if there is guidance and support from TOC that Incubation would be better fit would be happy to discuss and adjust.

[bdaw]

I would like to group and quote all more comprehensive comments made under specific company names in #406

"We at Bosch use Keycloak as an identity and access management system. We provide dedicated Keycloak instances internally as an SaaS offering with dozens of instances already running supporting a wide range of customer requirements.
It runs in a Kubernetes environment, using CNCF technologies like Helm, Prometheus, Grafana, Loki and fluentd. We have successfully contributed features we need to Keycloak and are really happy about how our contributions are handled by the Keycloak team. We are planning to add more contributions, especially around around the Keycloak operator we plan to introduce.
With the roadmap including things like Keycloak running on top of Quarkus, we think Keycloak is on the best way to become more cloud native. We would love to see it in the CNCF."

---

"We at Zalando (CNCF End User Supporter) are using Keycloak across some departments, with lots of extensions to support our cases. We deploy it via Kubernetes, and we see that having Keycloak joining CNCF would be a great step for the project, which could leverage being close to all the graduated systems from CNCF, receiving support and resources from the experts that manage to accomplish those graduations."

---

"We use Keycloak in Cisco IT. It is the main component of the CIAM implementation we have. We chose Keycloak because of its vibrant and helpful community.
Keycloak is at the heart of many IAM implementations and I think it would greatly benefit the community if Keycloak is accepted in CNCF."

---

"Backbase use Keycloak at the heart of our IAM solution for many Banks, Credit Unions and other FIs globally, and normally deploys it on Kubernetes in a cloud-based environment. The community around Keycloak is also well established, friendly, active and helpful, and we are proud to have contributed back to Keycloak. The Keycloak core team are open to contribution and have a mature process for managing this.

We think Keycloak is a great fit for the CNCF and is an important and mature part of the open source IAM space."

---

"+1 Super Supportive! We (Government of British Columbia) have been using KeyCloak in production for about 2years. It solved a major pain point for developers working with the various government identity providers. CNCF all the way."

---

"We have been using Keycloak (RedHat SSO) for at least a couple of years if not longer, at Fresenius Medical Care North America IT Group. It's been very helpful for us to offer OAuth JWT based authentication to our applications as a facade to our legacy Access Management and Identify Management systems in the back end. I would like to see Keycload pick up more support, so that it can keep up or exceed industry leading solution."

---

"In Cloudtrust (https://github.com/cloudtrust), we are intensively using Keycloak as the core component of our IdP. Our identity provider is offered in SaaS mode, and hosted on a multi-site OKD / OpenShift platform, with high availability as one of the main constraints. Deploying and managing Keycloak in this context is pretty easy, and extending the features in order to cover our specific business needs is really neat.
We also had to extend core features (multi-token support, SAML artifact-binding support), and the community is efficient and responsive for discussing the design, and reviewing the PR before merging it into the product. We do continue extending features, and pushing additional core features. We strongly believe that choosing Keycloak is one of the key success factors of our cloud-hosted platform."

---

"+1 for U.S Air Force."

---

Hitachi :
"＋１We are using Keycloak in production for the financial and public sectors to secure API/microservice."

"+1 Keycloak is essential to secure API/microserivce by OAuth/OIDC on cloud.
Keycloak also has wide range of features to secure API, and keycloak community is very active and friendly, the community accepts proposal other than original members.
FYI: Presentations about why keycloak is good to secure APIs, and community is active.
https://www.slideshare.net/ssuserbeb7c0/apidays-paris-2019-financialgrade-api-securityprofile
https://www.slideshare.net/YuichiNakamura10/implementing-security-requirements-for-banking-api-system-using-open-source-software-oss"

---

NTT Communications :
"+1 Yes, Keycloak is very promising and deserves it. It is easy to use, well-documented, and has enough features to be used in cloud native environment."

---

Nomura Research Institute, Ltd. :
"We're using keycloak in cloud native environment, including k8s and so on."

---

[bdaw]

Would also like to add few other publicly accessible websites which are using Keycloak OSS and we are aware of.

AT&T: https://apimarket.att.com/auth/realms/att/account

Sonatype: https://auth.sonatype.com/auth/

Hy-Vee: https://accounts.hy-vee.com/auth/

UK Home Office: Presentation of their use of Keycloak

Telia: https://developer.telia.io/

Please Open It: https://please-open.it/

Landen: https://cloud-iam.landen.co/

Investopedia: https://www.investopedia.com/auth/realms/investopedia/

Blazemeter: https://auth.blazemeter.com/auth/realms/blazect/

Truck Assist: https://truckassist.com.au/auth/realms/truckassist

Personal Genome: https://personalgenomes.ca/auth/realms/PGPCanada/

Red Hat: https://sso.redhat.com/auth/realms/redhat-external

[bdaw]

Here are two newly recorded videos giving quickest possible introduction to the project:

Keycloak Pitch [1m 42s]
https://www.youtube.com/watch?v=GZTN_VXjoQw

Keycloak Introduction [32min 11s]
https://www.youtube.com/watch?v=duawSV69LDI

[bdaw]

@amye With recent changes being introduced into Sandbox process I would like to change the submission to be for Incubation.

Sandbox in new form which is being introduced doesn't fit Keycloak which is already a mature and widely adopted project. At the same time I do believe Keycloak meets all of required Incubation criteria.

[amye]

@bdaw: As part of this process, you'll need to have a TOC sponsor for Due Diligence if you'd like to submit for incubation. We have Due Diligence guidelines and the Incubating Process page has more details for what needs to be included in the proposal if you'd like to change to incubation.

[bdaw]

@amye as I am away rest of the week will investigate any missing information in the submission regarding Incubation Process early next week.

Is it responsibility of the project to establish a sponsor to perform DD for Incubation or one is assigned as part of the process?

[amye]

@bdaw - see https://github.com/cncf/toc/tree/master/process#project-graduation-process-sandbox-to-incubating. The project should ask for a sponsor from the TOC to move the project forward.

[bdaw]

@amye Just to clarify and double check:

• I understand I need to provide additional information listed in the process. Is it enough I add those as a comment here or should I open a brand new PR?

• Do I understand correctly that I don't to need personally find a TOC sponsor for performing DD to move forward. Providing necessary information listed in the process being a formal request to TOC to establish such sponsor as part of the process you linked.

[amye]

Do I understand correctly that I don't to need personally find a TOC sponsor for performing DD to move forward. Providing necessary information listed in the process being a formal request to TOC to establish such sponsor as part of the process you linked.

No, you do need to have a TOC sponsor to move Due Diligence forward, and it's the responsibility of the projecs to find sponsors. However, to start the process, an incubation proposal is the first step.

I'd suggest opening a new PR with the incubation focus instead of adding here.

[mattfarina]

For reference, Keycloak was covered in Oct 2018 in a TOC meeting. The video is here and the slides are here.

[bdaw]

@amye Here is new PR: #463

I have extended this Sandbox application and added specific section for each Incubation requirement. Hope it contains all required informations.

[amye]

Closing as there's an incubation request in as well.