Skip to content

Groups

A group collects users so that access can be granted once, to the group, instead of repeatedly to individuals.

Create the groups before the users. The user form lets you tick the groups a new person belongs to, which is far less work than adding people to groups one at a time afterwards.

For the same steps in the console, see the console walkthrough.

Create

group.yaml
apiVersion: v1.edp.epam.com/v1
kind: KeycloakRealmGroup
metadata:
  name: <group>
  namespace: <project>
spec:
  name: <group>
  realmRef:
    name: <domain-object-name>
  description: <what this group is for>

oc apply -f group.yaml

realmRef takes the object name, not the domain

realmRef.name is the metadata.name of the KeycloakRealm - the one with hyphens instead of dots, such as example-com. Passing the domain itself, or a realmName field, does not resolve.

Name a group for the role people hold rather than for the thing they are allowed to touch. support survives a reorganisation; can-read-billing-db stops being true the moment the permission changes.

Nesting

A group can sit under another:

spec:
  parentGroup:
    name: <parent-group-object-name>

A child inherits everything the parent has. Putting a narrow group under a broad one therefore gives its members everything the broad group holds, which is rarely what was intended. Nest only when that inheritance is what you want.

The parent cannot be changed afterwards - a group in the wrong place has to be recreated.

List

oc get keycloakrealmgroups.v1.edp.epam.com -n <project>

The status reports OK once the group exists in the realm:

oc get keycloakrealmgroups.v1.edp.epam.com <group> -n <project> \
  -o jsonpath='{.status.value}{"\n"}'

An error naming the realm means the domain is not ready. Check the domain reports OK first, then recreate the group.

Change

The description can be changed in place:

oc patch keycloakrealmgroups.v1.edp.epam.com <group> -n <project> \
  --type=merge -p '{"spec":{"description":"<description>"}}'

The group name, the realm and the parent are all fixed once created.

Membership is not held on the group. A user's groups are listed on the user object, so adding someone to a group means editing that user - see Users.

Delete

oc delete keycloakrealmgroups.v1.edp.epam.com <group> -n <project>

Deleting a group removes it from the realm and from every user who was in it. Those users keep their accounts and lose whatever the group gave them.

Delete child groups before their parent, or they are left pointing at a parent that no longer exists.