<p>I am using <a href="https://postgres-operator.readthedocs.io/en/latest/" rel="nofollow noreferrer">https://postgres-operator.readthedocs.io/en/latest/</a> and have deployed:</p>

<pre><code>kind: "postgresql"
apiVersion: "acid.zalan.do/v1"

metadata:
  name: "acid-databaker-db"
  namespace: "dev"
  labels:
    team: acid

spec:
  teamId: "acid"
  postgresql:
    version: "12"
  numberOfInstances: 2
  volume:
    size: "2Gi"
  users:
    admin:
      - superuser
      - createdb
    kcadmin: [] 
  databases:
    keycloak: kcadmin
  allowedSourceRanges:
    # IP ranges to access your cluster go here

  resources:
    requests:
      cpu: 100m
      memory: 100Mi
    limits:
      cpu: 500m
      memory: 500Mi
</code></pre>

<p>everything is up and running and I can connect to database, but I do not understand this part:</p>

<pre><code>  users:
    admin:
      - superuser
      - createdb
    kcadmin: [] 
  databases:
    keycloak: kcadmin
</code></pre>

<p>According to the <a href="https://postgres-operator.readthedocs.io/en/latest/user/#prepared-databases-with-roles-and-default-privileges" rel="nofollow noreferrer">doc</a>, <code>admin</code> is a role - right? 
What about <code>kcadmin</code>? Is it an <code>user</code> or <code>role</code>? If it is an user, what kind of role does the <code>kcadmin</code> has? </p>

<p>This is a community wiki answer based on the correct info from the comments and with more explanation and details. </p>

<p>In your use case:</p>

<pre><code>  users:
    admin:
      - superuser
      - createdb
    kcadmin: [] 
  databases:
    keycloak: kcadmin
</code></pre>

<p>we see two users: <code>admin</code> and <code>kcadmin</code>.</p>

<p>User <code>admin</code> has two manifest roles: <code>superuser</code> and <code>createdb</code>.</p>

<p>User <code>kcadmin</code> has no manifest roles. </p>

<p>Manifest roles are defined as a dictionary, with a role name as a key and a list of role options as a value. For a role without any options it is best to supply the empty list <code>[]</code>, like with your <code>kcadmin</code> user. </p>

<p>The following roles can be used: <code>superuser</code>, <code>inherit</code>, <code>login</code>, <code>nologin</code>, <code>createrole</code>, <code>createdb</code>, <code>replication</code> and <code>bypassrls</code>.</p>

<p>I hope it helps.</p>
