Feature request: Add more arguments to keycloak resource

[HanXHX]

Hi!

With current keycloak resource, we can't get/set some data (admin creds, version... etc). We can't use it in a global terraform process :(

It would be awesome to perform something like:

resource "clevercloud_keycloak" "main" {
  name = "test"

  version = "26.4.1"

  domain_name {
    custom_domain = "auth.myapp.tld"
  }

  domain_name {
    custom_domain = "auth.another-app.tld"
  }

  lifecycle {
    ignore_changes = [
      version
    ]
  }
}

# Link with https://search.opentofu.org/provider/keycloak/keycloak/v5.2.0
provider "keycloak" {
  client_id     = clevercloud_keycloak.main.admin_creds.client_id
  client_secret = clevercloud_keycloak.main.admin_creds.creds_client_secret
  url           = clevercloud_keycloak.main.admin_creds.url
}

resource "keycloak_realm" "main" {
  realm        = "my_realm"
  enabled      = true
  display_name = "My Realm"
#...
}

And why not provides custom admin creds?

resource "random_password" "keycloak_admin" {
  length  = 32
}

resource "clevercloud_keycloak" "main" {
  name = "test"

  admin_creds {
    client_id        = "supa_admin"
    client_secret = random_password.keycloak_admin.result
  }

}

Cheers!

Emilien

[davlgd]

With current keycloak resource, we can't get/set some data (admin creds, version... etc). We can't use it in a global terraform process :(

Most of it is available through API, so it will be easy to add here.

About domain_name what are you exactly using these multiple domains for ? (we currently let user provide an access-domain which is used for web UI for example.

And why not provides custom admin creds?
client_id = "supa_admin"

Would this really change something for you (supa_admin rather than cc-account-admin) ?

resource "random_password" "keycloak_admin" {
length = 32
}

Keycloak requirements are more complex than that. And 1st thing Keycloak asks is to change the initial provided password. Is it ok for you or do you need to provide a password which won't be temporary? I'll check how we could handle such need with team.

[HanXHX]

Hi,

My current usage:

• I use https://xxxxxxxxxxx.services.clever-cloud.com for master realm and administrative stuff
• I use https://a-specific-subdomain.myapp.tld as frontend for the realm MyApp

Just see the screen, the custom domain with green color.

On clever-cloud side, the resource should add custom domain. In keycloak side, it's already done with keycloak terraform provider.

---

cc-account-admin is a webconsole user. It shouldn't be used as programmative stuff + stored in clear in your side (env vars). If it's changed in keycloak, its breaks the terraform/opentofu workflow. It's fine for first web admin login not for middle/long term usage.

I think the best way is to provide/push a service account client with admin role in master realm. In my instance, I manually created this one. The admin-cli client is disabled in your setup. Maybe clone the admin-cli to cc-admin-cli?

---

The expected workflow is (without any manual actions)

1. Create Keycloak instance (with or without input credentials)
2. Get the admin creds and setup keycloak...

I like CC, you're very nice. But I don't want to log in your web console / keycloak console just for a tofu apply / terraform apply 😸

[miton18]

Some of the needs will be addressed by #316.

for the multiple domains, can a CNAME record do the job ?

[HanXHX]

Hey @miton18

Thanks 🥇

About InitialCredentials.User, is it the cc-account-admin?

Yep I did DNS stuff in my side 😸

[HanXHX]

For #315, it should be nice to export the fs bucket id too

[miton18]

For #315, it should be nice to export the fs bucket id too

Yes, with #315, you will be able to use clevercloud_keycloak.somename.fsbucket_id