Skip to content

IDENTITY PLANE

Haven

Keycloak + HA PostgreSQL, shipped and operated as one product — one console, one intent object, day-2 ops that don't require reading three operators' docs.

Keycloak Operator 26.8.0 CloudNativePG 1.30.1 Apache-2.0

Get the highlights.

  • v0.1.01
    Only tagged release today — a v0 packaging layer, not the v1 controller
  • 32
    Custom resources: IdentityPlane, RealmBundle, OidcClient
  • 102
    Reconciliation steps from namespace to a Ready plane
  • 133
    Deterministic security rules Haven Guard checks (HAVEN001–013)
  • 54
    CLI commands: deploy, status, doctor, admin, backup

Haven turns Keycloak and PostgreSQL into one private-cloud identity product. These docs cover how to deploy it, operate it day-to-day, and how the pieces fit together.

Published site: zyvorai.github.io/zyvor-haven · Preview locally: make docs-serve

Convention: run every command from the Haven repo root (the directory that contains Makefile, cli/haven, and scripts/).

The three custom resources

  • IdentityPlane The root object. One plane ≈ one Keycloak cluster + one PostgreSQL cluster + how the world reaches them — profile, database, Keycloak version/resources, exposure, and bootstrap realm/clients all live here.
  • RealmBundle A declarative realm (users optional, clients, roles, IdPs, theme), applied via the Keycloak Realm Import CR plus a small Haven overlay for what the import job doesn't cover — client secrets stored as Kubernetes Secrets, rotation.
  • OidcClient A client that belongs to a realm and must exist for platform SSO. The controller ensures the client exists in Keycloak and writes a Secret the workload can mount (client-id, client-secret, issuer).

Documentation map

Operations

Doc Contents
Getting started Choose a deployment path (local, lab, production)
Runbook Install operators, four deployment paths, day-2 ops, failure cheatsheet
Lab host Endpoints, SSH, OIDC wiring for
Console Routes, auth modes, remote deploy, local UI dev
Tutorials Console recipes: realms, clients, passwords
CLI ./cli/haven commands and Makefile targets

Design

Doc Contents
Architecture CRDs, reconcile order, profiles, trust model
UX Command Deck, deploy wizard, visual language
Private cloud Zeus OS mapping, platform SSO catalog, tenancy
Roadmap v0 / v1 / v2 scope

Deploy overlays (in-tree)

Path Contents
production-overlay.md Production prerequisites: secrets, TLS, CNPG CA
backups.md Backup object store setup

Deployment paths at a glance

flowchart LR
  subgraph v0["v0 — works today"]
    A[install operators] --> B[make dev]
    B --> C[make wait / doctor / admin]
    D[deploy-remote.sh] --> E[Console on lab host]
  end

  subgraph later["v1 — controller"]
    F[IdentityPlane CR] --> G[Haven controller reconciles]
    G --> H[CNPG + Keycloak + certs + console]
  end

  B -.->|"stores intent only"| F
Path Status Entry point
Compose (local) Supported make dev — see runbook Path B
Lab console Supported ./scripts/deploy-remote.sh <ephemeral-ip> operator — see lab-host.md
Production overlay Shape only production-overlay.md
IdentityPlane CR Intent only (until v1 controller) make samples-dev

External references

  1. The README states only one tagged release exists, 0.1.0, and frames this repository as v0 — the Helm chart installs RBAC only today; the full Kubebuilder reconcile loop is v1, in progress. See the README. ↩
  2. IdentityPlane, RealmBundle, and OidcClient are the three CRDs; the controller applies them across a 10-step reconciliation order from namespace/NetworkPolicy creation through marking the plane Ready. See Architecture. ↩
  3. Haven Guard's rule table lists HAVEN001 through HAVEN013 across critical/high/medium/low severity. See Security posture. ↩
  4. The CLI (./cli/haven) and Makefile targets cover deploy, status, doctor, admin, and backup. See CLI. ↩