Nested groups are flattened and hierarchy is ignored

[JSchlarb]

When I create groups with parentGroupRef, they all end up at root level instead of being nested. The hierarchy is completely ignored.

What I'm trying to do:

grafana/
grafana/admin
grafana/viewer

What I get:

grafana
admin
viewer

KeycloakGroup

apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana
spec:
  clusterRealmRef: a-realm
  definition:
    name: grafana
    path: /grafana
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana-admin
spec:
  clusterRealmRef: a-realm
  parentGroupRef: grafana
  definition:
    name: admin
    path: /grafana/admin
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana-viewer
spec:
  clusterRealmRef: a-realm
  parentGroupRef: grafana
  definition:
    name: viewer
    path: /grafana/viewer

KeycloakApiObject

apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakApiObject
metadata:
  creationTimestamp: "2025-08-15T19:34:21Z"
  finalizers:
  - rustcloak.k8s.eboland.de/finalizer
  generation: 1
  labels:
    rustcloak.k8s.eboland.de/instanceRef: a-realm
  name: group-grafana
  namespace: keycloak
  ownerReferences:
  - apiVersion: rustcloak.k8s.eboland.de/v1beta1
    kind: KeycloakGroup
    name: grafana
    uid: 24718dfa-0fc1-4f8f-8ddd-3d55fbd0b807
  resourceVersion: "14884232"
  uid: b02751ec-0de4-43e1-abb9-a6db3c7816e1
spec:
  endpoint:
    clusterInstanceRef: a-realm
    initWorkflow: POST
    path: /admin/realms/a-realm/groups
    realm:
      clusterRealmRef: a-realm
  immutablePayload: '{}'
  options: {}
  payload: |
    name: grafana
    path: /grafana
status:
  instance:
    clusterInstanceRef: a-realm
  message: ok
  ready: true
  realm:
    clusterRealmRef: a-realm
  resourcePath: /admin/realms/a-realm/groups/d3304f70-870e-4f34-8825-22051b578aaa
  status: Applied
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakApiObject
metadata:
  creationTimestamp: "2025-08-15T19:34:21Z"
  finalizers:
  - rustcloak.k8s.eboland.de/finalizer
  generation: 1
  labels:
    rustcloak.k8s.eboland.de/instanceRef: a-realm
  name: group-grafana-admin
  namespace: keycloak
  ownerReferences:
  - apiVersion: rustcloak.k8s.eboland.de/v1beta1
    kind: KeycloakGroup
    name: grafana-admin
    uid: c9e541df-b4c6-4100-acf4-a802dd7705eb
  resourceVersion: "14884264"
  uid: cd765893-305f-4cc0-ae0b-c011e75abd87
spec:
  endpoint:
    clusterInstanceRef: a-realm
    initWorkflow: POST
    path: /admin/realms/a-realm/groups
    realm:
      clusterRealmRef: a-realm
  immutablePayload: '{}'
  options: {}
  payload: |
    name: admin
    path: /grafana/admin
status:
  instance:
    clusterInstanceRef: a-realm
  message: ok
  ready: true
  realm:
    clusterRealmRef: a-realm
  resourcePath: /admin/realms/a-realm/groups/07c4723d-a123-4f79-80ec-62b28b16d1d7
  status: Applied
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakApiObject
metadata:
  creationTimestamp: "2025-08-15T19:36:03Z"
  finalizers:
  - rustcloak.k8s.eboland.de/finalizer
  generation: 1
  labels:
    rustcloak.k8s.eboland.de/instanceRef: a-realm
  name: group-grafana-viewer
  namespace: keycloak
  ownerReferences:
  - apiVersion: rustcloak.k8s.eboland.de/v1beta1
    kind: KeycloakGroup
    name: grafana-viewer
    uid: 2d600d5c-3a86-4932-933f-a1d32074bb2d
  resourceVersion: "14884259"
  uid: c0555a51-921b-4bbc-8d6a-45368e733dc9
spec:
  endpoint:
    clusterInstanceRef: a-realm
    initWorkflow: POST
    path: /admin/realms/a-realm/groups
    realm:
      clusterRealmRef: a-realm
  immutablePayload: '{}'
  options: {}
  payload: |
    name: viewer
    path: /grafana/viewer
status:
  instance:
    clusterInstanceRef: a-realm
  message: ok
  ready: true
  realm:
    clusterRealmRef: a-realm
  resourcePath: /admin/realms/a-realm/groups/66e8643c-c355-4d12-bdff-85e0c248b369
  status: Applied

keycloak=# select * from keycloak_group;
                  id                  |  name   | parent_group |               realm_id               | type | description
--------------------------------------+---------+--------------+--------------------------------------+------+-------------
 d3304f70-870e-4f34-8825-22051b578aaa | grafana |              | 97b5f4fc-d885-46da-b6df-740bbddaaca3 |    0 |
 66e8643c-c355-4d12-bdff-85e0c248b369 | viewer  |              | 97b5f4fc-d885-46da-b6df-740bbddaaca3 |    0 |
 07c4723d-a123-4f79-80ec-62b28b16d1d7 | admin   |              | 97b5f4fc-d885-46da-b6df-740bbddaaca3 |    0 |
(3 rows)

[Gottox]

Do not set clusterRealmRef when defining a parentGroupRef. It's an "either-or".

apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana
spec:
  clusterRealmRef: a-realm
  definition:
    name: grafana
    path: /grafana
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana-admin
spec:
  parentGroupRef: grafana
  definition:
    name: admin
    path: /grafana/admin
---
apiVersion: rustcloak.k8s.eboland.de/v1beta1
kind: KeycloakGroup
metadata:
  name: grafana-viewer
spec:
  parentGroupRef: grafana
  definition:
    name: viewer
    path: /grafana/viewer

[JSchlarb]

This is an unfixed CRD schema bug.

The crd uses anyOf for parentRef validation, which allows multiple parent fields to be set at the same time. For the intended behavior (exactly one parentRef), this must be oneOf.

https://github.com/DenktMit-eG/rustcloak-operator/blob/1f4b906bb605c82d3217f5b5401ef560d51e152d/charts/rustcloak-operator/crds/keycloakgroups.rustcloak.k8s.eboland.de.yaml#L37C1-L44C31

[Gottox]

Thanks for the reopen! Could be an actual bug. I suspect schemars. Let me create a reduced testcase.