Security & Identity

Auth

Identity and access management — Keycloak with database, TLS, and routing.

Component:Auth

Examples

Simple Keycloak instance

import { Auth } from '@r8s/recipes'

export default <Auth name="auth" host="auth.example.com" />

Keycloak with custom storage and TLS

import { Auth } from '@r8s/recipes'

export default (
  <Auth
    name="auth"
    host="auth.example.com"
    instances={2}
    storage="20Gi"
    tls={{ secretName: 'auth-tls', clusterIssuer: 'letsencrypt-prod' }}
  />
)

Keycloak with realms and clients

import { Auth } from '@r8s/recipes'
import { Realms, Realm, Clients, Client } from '@r8s/recipes/auth'

export default (
  <Auth name="auth" host="auth.example.com">
    <Realms>
      <Realm id="company" displayName="Company">
        <Clients>
          <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
          <Client id="api" type="bearer-only" />
        </Clients>
      </Realm>
    </Realms>
  </Auth>
)

Keycloak with EntraID federation

import { Auth } from '@r8s/recipes'
import { Realms, Realm, Clients, Client, EntraID } from '@r8s/recipes/auth'

export default (
  <Auth name="auth" host="auth.example.com">
    <Realms>
      <Realm id="company" displayName="Company">
        <EntraID
          tenantId="your-tenant-id"
          clientId="your-client-id"
          clientSecret="${env:ENTRA_CLIENT_SECRET}"
        />
        <Clients>
          <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
        </Clients>
      </Realm>
    </Realms>
  </Auth>
)

Props

namestringRequired—

Resource name

hoststringRequired—

Public hostname for the identity provider (e.g., 'auth.example.com')

namespacestringOptional—

Kubernetes namespace (defaults to 'default')

instancesnumberOptional—

Number of Keycloak replicas (defaults to 1)

storagestringOptional—

Database storage size (defaults to '10Gi')

tlsTLSConfigOptional—

TLS certificate configuration

childrenunknownOptional—

Child components (Realms)

←All recipes