Platform foundation
Keycloak
Single sign-on identity provider for seven apps on the cluster
What it does
Keycloak is an identity provider that issues OpenID Connect logins, so every app can delegate authentication to one place instead of keeping its own user database.
How it runs here
Runs as a single replica in the postgres-operator namespace, backed by its own database on the shared PostgreSQL cluster. Its realm is the OIDC issuer for seven apps' logins, including GitLab, Argo CD, Dependency-Track, Open WebUI and Uptrace.
Connects to
Why I chose it
Centralizing login in one identity provider means one place to disable a user or rotate credentials, instead of doing it per app.