Keycloak, An Optimized Image Proven Through The Admin API

Keycloak 26 (SHA-256 pinned) on Java 21, an image the service cannot write to, on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test takes an admin token, sees a wrong password and an anonymous admin request refused, creates a realm (201), duplicates it (409), reads its OpenID discovery document and deletes it. Original role, live-tested on Rocky Linux 10.

ansibleSecurity & Secrets

Verification

Live-tested

Really deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.

Conformance

  • Static validation (yamllint · ansible-lint)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.

README.md, GitLab, Gitea
[![IaC Bazaar: live-tested](https://www.iac-bazaar.com/api/artifacts/ansible-keycloak/badge)](https://www.iac-bazaar.com/catalog/ansible-keycloak?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Ansible role 1.0.0, live-tested on IaC Bazaar: [Keycloak, An Optimized Image Proven Through The Admin API](https://www.iac-bazaar.com/catalog/ansible-keycloak?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```yaml
# Keycloak, An Optimized Image Proven Through The Admin API: https://www.iac-bazaar.com/catalog/ansible-keycloak (download from your IaC Bazaar account)
```

Preview:IaC Bazaar: live-tested

Documentation

keycloak

Keycloak from the upstream release (SHA-256 pinned), on Java 21 from AppStream, built once into an optimized server image the service cannot write to, as a hardened system service on loopback with health and metrics on the management port. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, and the release is run in place. EL 10 carries no Keycloak; the vendor publishes a PGP signature beside the release and no checksum file, so this role pins the SHA-256 beside the version and has Ansible's get_url refuse the asset unless it matches. The tree is unpacked under /usr/local/src, root-owned, and the unit runs bin/kc.sh from inside it: nothing is copied into the PATH. A new release is a new pair, on purpose.

A service account, a hardened unit, a loopback listener. keycloak is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Proven through the admin API. The live test waits for /health/ready on the management port, takes an admin token with the password grant, sees a wrong password refused and an anonymous admin request answered 401, creates a realm (201), creates it again (409), reads the realm's OpenID discovery document, deletes it (204) and reads the JVM metrics.

The tree stays root-owned. kc.sh build runs as root whenever keycloak.conf changes (it is the template's validate step, so a build the server refuses fails the render before the file lands) and the unit starts the optimized image; the only path Keycloak writes at runtime, <home>/data, is a link into /var/lib/keycloak. The live test runs on the embedded dev-file store; set keycloak_db and the connection variables for a PostgreSQL, MariaDB or MySQL, and keycloak_hostname plus keycloak_proxy_headers behind the proxy that terminates TLS.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Variables
  • Test

Related modules

Live-tested

ansible-authelia

Authelia from the upstream release (sha256-verified) as a hardened system service on loopback with file users and sqlite; its secrets are generated once on the host and reach the service as AUTHELIA_*_FILE variables. The live test hashes a password with Authelia's hasher, logs in, sees a wrong password refused and an anonymous visitor sent to the portal. Original role, live-tested on Rocky 10.

View module
Live-tested

ansible-bandit

bandit on EL 10 from PyPI into a venv of its own with a link in the PATH; the live test runs pip check, then scans a module that passes a string to subprocess.call with shell=True (B602, High, exit 1) and a clean module (exit 0). Pinned. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-base-hardening

SSH hardening drop-in, sysctl security profile, login banner, and time sync. Original, live-tested (Molecule) role.

View module
Live-tested

ansible-boundary

boundary on EL 10 from releases.hashicorp.com; SHA256SUMS is signature-checked against HashiCorp's key before get_url trusts it, the live test re-checks both, then runs authenticate against a dead address ('connection refused') and database init with a throwaway config (parsed, root key loaded, then the database refused). Pinned. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-dockle

dockle on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then scans a one-layer image whose config names no user, expecting CIS-DI-0001 in the output, exit code 1 with --exit-level warn, and the warning counted in the JSON form. Pinned. Original role, live-tested on Rocky Linux 10.

View module
Live-tested

ansible-gitleaks

gitleaks on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the project's checksums file, and re-checked with sha256sum -c by the live test, which then plants a file holding an AWS access key that is not one and runs gitleaks detect over it, expecting 'leaks found: 1'. Original role, live-tested on Rocky Linux 10.

View module