Manage Keycloak users/groups in Git (GitOps)

Summary

Note: this issue proposes a short term implementation of , i.e. keycloak user/groups management in a gitops way. However, the target solution should manage user management and the Sylva lifecycle independently, i.e. users/groups declaration is not part of the sylva helmrelease values.

Implement a new sylva-core unit that declares a GitRepository + Kustomization which produces a ConfigMap containing Keycloak users/groups definitions. This ConfigMap will be provided as a valuesFrom input to the existing keycloak-user-management unit (Helm release), enabling cluster-ops teams to manage Keycloak users/groups via Git (GitOps).

Background

Implement a GitOps-friendly flow to manage Keycloak accounts: cluster operators should be able to define users and groups in a Git repository. sylva-core should reconcile that repo and provide the resulting ConfigMap to the keycloak-user-management Helm release. This follows the following proposal:

• add a unit that defines a GitRepository + Kustomization
• point it to a Git repo that defines a ConfigMap
• provide the ConfigMap as valuesFrom input to the keycloak-user-management unit Similar pattern already exists for workload clusters (see workload-teams-repo): https://gitlab.com/sylva-projects/sylva-core/-/blob/main/charts/sylva-units/values.yaml Keycloak user-management Helm chart is defined the following repo https://gitlab.com/sylva-projects/sylva-elements/helm-charts/keycloak-user-management

Proposal (detailed)

1. Add a new unit keycloak-user-groups-repo.The unit should:
   • create a GitRepository resource
   • create a Kustomization resource that targets the repo path containing a ConfigMap manifest
   • ensure the Kustomization outputs a ConfigMap (e.g. name: keycloak-users-cm) whose data key holds Helm values expected by keycloak-user-management (for instance values.yaml)
2. Update the keycloak-user-management unit wrapper to accept valuesFrom input that references a ConfigMap created by the new unit
   • Merge the ConfigMap data into Helm values for the release
   • Maintain backwards compatibility: if valuesFrom not provided, behavior unchanged
3. Provide an example Git repo layout and documentation:
   • sample ConfigMap manifest with users/groups in the chart-expected format
   • README showing how operators manage users via PRs
   • example sylva-core values.yaml showing unit declaration and reference
4. Tests and CI
   • unit/integration tests for flow: Git repo → Kustomization → ConfigMap → keycloak-user-management Helm release
   • acceptance test verifying users/groups are created in Keycloak