Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not delete Keycloak items on Kubernetes object deletion by default #18

Closed
julianbuettner opened this issue Oct 26, 2023 · 5 comments
Closed
Assignees
Labels
enhancement New feature or request

Comments

@julianbuettner
Copy link

Is your feature request related to a problem? Please describe.
I just renamed the KeycloakRealm object and accidentally deleted the staging realm.
(renaming + kubectl apply = delete + create?)
There were backups in place, so everything turned out fine, but it's a hell of a trap to fall in.

Describe the solution you'd like
I would like to not have my realms deleted.
Maybe an annotation like delete-keycloak-object-on-kubernetes-deletion with a default of false,
which has to be explicitly set to true to keep the current behaviour. Examples could be updated, so the issue is
directly recognized by users not thinking much (like me).

(Compare "helm.sh/resource-policy": "keep")

Describe alternatives you've considered
Not using this product, because it contains a rather big footgun.
But I would like to use it in production, because it's otherwise exactly what I need.

Additional context
N/A

@SergK
Copy link
Member

SergK commented Oct 26, 2023

@julianbuettner Hello, I think we can make this field immutable and not allow such operations but force the user to create a new realm. @zmotso, what do you think? Since Keycloak API doesn't allow such stuff, recreation operations can be dangerous.

@zmotso
Copy link
Contributor

zmotso commented Oct 27, 2023

@SergK @julianbuettner Hi. Yes, we can add some annotation/parameter to the CR to prevent deletion of the realm. We can implement it shortly (in a week or two).

@julianbuettner
Copy link
Author

It would be great to have it for other (all?) object kinds as well, like KeycloakUser, KeycloakClient, etc, not just KeycloakRealm.
Although for KeycloakRealm I would need it the most.

@SergK SergK added the enhancement New feature or request label Nov 5, 2023
epmd-edp pushed a commit that referenced this issue Nov 9, 2023
Added 'edp.epam.com/preserve-resources-on-deletion: true' annotation processing to prevent the operator from deleting resources from keycloak.

Change-Id: I0301c611b7e2de8388363297720650340c891c15
@julianbuettner
Copy link
Author

It appears to me the issue is fixed, so I will close this issue now.
Thank you for implementing this request.
Is there an estimated time of the next release?

@SergK
Copy link
Member

SergK commented Nov 14, 2023

@julianbuettner, please expect till the end of this week.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Archived in project
Development

No branches or pull requests

3 participants