Kubernetes

Keycloak is the default answer when you need OIDC and SAML, a user federation layer, and an admin surface that other teams can operate — without writing an authorization server yourself. It joined the CNCF as an incubating project in 2023, and the 25.0 release (June 2024) is the cleanest it has ever been to run on Kubernetes: the WildFly distribution is gone, health and metrics moved off the public port, and hostname configuration was rebuilt. ...

Most teams that need an identity operation Keycloak doesn’t ship — “resolve this user’s effective entitlements in one call”, “let a user accept updated terms”, “expose a tenant-scoped lookup” — build a separate microservice. That service then has to validate Keycloak’s tokens, hold a service-account credential to call the Admin REST API, reconstruct realm and group logic over HTTP, and get deployed, scaled, and monitored as its own thing. It’s a lot of moving parts to add one endpoint. ...

Autoscaling is easy to explain and hard to see. The docs tell you a HorizontalPodAutoscaler watches CPU and adds pods — but to watch it happen you need a workload that burns CPU on demand, a deployment that reports its resource usage honestly, and a way to generate real traffic. This post wires all three together with a tiny Quarkus app, the quarkus-openshift extension, and k6. The full source is here: ozimakov-rh/quarkus-hello-world. It targets Quarkus 2.14 on Java 17. ...