<p>I want to deploy keycloak with below custom configuration, before starting it.</p>
<ul>
<li>new realm</li>
<li>role</li>
<li>client</li>
<li>an admin user under the new realm</li>
</ul>
<p>I am using below deployment file to create keycloak pod</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: default
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:10.0.1
        env:
        - name: KEYCLOAK_USER
          value: &quot;admin&quot;
        - name: KEYCLOAK_PASSWORD
          value: &quot;admin&quot;
        - name: REALM
          value: &quot;ntc&quot;
        - name: PROXY_ADDRESS_FORWARDING
          value: &quot;true&quot;
        volumeMounts:
        - mountPath: /opt/jboss/keycloak/startup/elements
          name: elements
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 443
        readinessProbe:
          httpGet:
            path: /auth/realms/master
            port: 8080
        volumes:
      - name: elements
        configMap:
          name: keycloak-elements
</code></pre>
<p>and using below cilent.json and realm.json file to generate configmap for keycloak.</p>
<p><strong>client.json</strong></p>
<pre><code>{
  &quot;id&quot;: &quot;7ec4ccce-d6ed-461f-8e95-ea98e4912b8c&quot;,
  &quot;clientId&quot;: &quot;ntc-app&quot;,
  &quot;enabled&quot;: true,
  &quot;clientAuthenticatorType&quot;: &quot;client-secret&quot;,
  &quot;secret&quot;: &quot;0b360a88-df24-48fa-8e96-bf6577bbee95&quot;,
  &quot;directAccessGrantsEnabled&quot;: true
}
</code></pre>
<p><strong>realm.json</strong></p>
<pre><code>{
 &quot;realm&quot;: &quot;ntc&quot;,
 &quot;id&quot;: &quot;ntc&quot;,
 &quot;enabled&quot;: &quot;true&quot;,
 &quot;revokeRefreshToken&quot; : true,
 &quot;accessTokenLifespan&quot; : 900,
 &quot;passwordPolicy&quot;: &quot;length(8) and digits(1) and specialChars(1)&quot;,
 &quot;roles&quot; : {
  &quot;realm&quot; : [ {
        &quot;id&quot;: &quot;c9253f52-1960-4c9d-af99-5facca0c0846&quot;,
        &quot;name&quot;: &quot;admin&quot;,
        &quot;description&quot; : &quot;admin role&quot;,
        &quot;scopeParamRequired&quot;: false,
        &quot;composite&quot;: false,
        &quot;clientRole&quot;: false,
        &quot;containerId&quot;: &quot;ntc&quot;
    }, {
      &quot;id&quot; : &quot;1e7ed0c8-9585-44b0-92f8-59e472573461&quot;,
      &quot;name&quot; : &quot;user&quot;,
      &quot;description&quot; : &quot;user role&quot;,
      &quot;scopeParamRequired&quot; : false,
      &quot;composite&quot; : false,
      &quot;clientRole&quot; : false,
      &quot;containerId&quot; : &quot;ntc&quot;
    }
   ]
  }
}
</code></pre>
<p>Both the files are saved under the <code>elements</code> folder and used in the below command to generate the config map:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl create configmap keycloak-elements --from-file=elements
</code></pre>
<p>Still, I don't see any new realm/role or client created in the <a href="https://i.stack.imgur.com/NXf97.png" rel="nofollow noreferrer">KeyCloak</a> console.</p>

<p>When you are setting up Keycloak on kubernetes, you only need to import the new realm (realm.json) and the corresponding clients (client.json) only during the first run. So a <strong>Job</strong> needs created instead of adding it to the deployment.</p>
<p>Once the Job is run, the json will be imported to the Keycloak database and the job can be suspended. Adding it to the deployment will cause Keycloak to try and import the json files during each restart.</p>
<p>Please follow the steps in this blog post: <a href="https://blog.knoldus.com/migrate-keycloak-h2-database-to-postgres-on-kubernetes/" rel="nofollow noreferrer">https://blog.knoldus.com/migrate-keycloak-h2-database-to-postgres-on-kubernetes/</a></p>
