<p>The Keycloak operator uses Quarkus: <a href="https://github.com/keycloak/keycloak/tree/main/operator" rel="nofollow noreferrer">https://github.com/keycloak/keycloak/tree/main/operator</a></p>
<p>In <code>application.properties</code> (<a href="https://github.com/keycloak/keycloak/blob/main/operator/src/main/resources/application.properties" rel="nofollow noreferrer">https://github.com/keycloak/keycloak/blob/main/operator/src/main/resources/application.properties</a>) we can set environment variables:
<a href="https://quarkus.io/guides/deploying-to-kubernetes#environment-variables-from-keyvalue-pairs" rel="nofollow noreferrer">https://quarkus.io/guides/deploying-to-kubernetes#environment-variables-from-keyvalue-pairs</a></p>
<p>For example:</p>
<pre><code>quarkus.kubernetes.env.vars.kc-hostname=localhost
quarkus.kubernetes.env.vars.kc-proxy=edge
quarkus.kubernetes.env.vars.proxy-address-forwarding=true
</code></pre>
<p>In the Kubernetes manifests which are generated, these environment variables appear in the <em>operator</em> container:</p>
<pre><code>    spec:
      containers:
        - env:
            ...
            - name: KC_HOSTNAME
              value: localhost
            - name: PROXY_ADDRESS_FORWARDING
              value: &quot;true&quot;
            ...
            - name: KC_PROXY
              value: edge
          image: keycloak/keycloak-operator:19.0.2
          imagePullPolicy: Always
</code></pre>
<p>However, I need them to be set in the <em>application</em> container, instead.</p>
<hr />
<p>Here is another verification of this. The running operator container:</p>
<pre><code>$ kubectl describe pod keycloak-operator --namespace=keycloak


Name:             keycloak-operator-6479dbc544-2wl4d
...
Controlled By:  ReplicaSet/keycloak-operator-6479dbc544
Containers:
  keycloak-operator:
    Image:          keycloak/keycloak-operator:19.0.2
    ...
    Environment:
      KUBERNETES_NAMESPACE:      keycloak (v1:metadata.namespace)
      KC_HOSTNAME:               localhost
      PROXY_ADDRESS_FORWARDING:  true
      OPERATOR_KEYCLOAK_IMAGE:   quay.io/keycloak/keycloak:nightly
      KC_PROXY:                  edge
</code></pre>
<p>and using the application manifest provided here (<a href="https://www.keycloak.org/operator/basic-deployment#_deploying_keycloak" rel="nofollow noreferrer">https://www.keycloak.org/operator/basic-deployment#_deploying_keycloak</a>) here is the running application pod:</p>
<pre><code>$ kubectl describe pod example-kc --namespace=keycloak

Name:             example-kc-0
Namespace:        keycloak
...
Containers:
  keycloak:
    Container ID:  
    Image:         quay.io/keycloak/keycloak:nightly
    ...
    Environment:
      KC_CACHE_STACK:                 kubernetes
      KC_HEALTH_ENABLED:              true
      KC_CACHE:                       ispn
      KC_DB:                          postgres
      KC_DB_URL_HOST:                 postgres-db
      KC_DB_USERNAME:                 &lt;set to the key 'username' in secret 'keycloak-db-secret'&gt;        Optional: false
      KC_DB_PASSWORD:                 &lt;set to the key 'password' in secret 'keycloak-db-secret'&gt;        Optional: false
      KEYCLOAK_ADMIN:                 &lt;set to the key 'username' in secret 'example-kc-initial-admin'&gt;  Optional: false
      KEYCLOAK_ADMIN_PASSWORD:        &lt;set to the key 'password' in secret 'example-kc-initial-admin'&gt;  Optional: false
      jgroups.dns.query:              example-kc-discovery.keycloak
      KC_HOSTNAME:                    test.keycloak.org
      KC_HTTPS_CERTIFICATE_FILE:      /mnt/certificates/tls.crt
      KC_HTTPS_CERTIFICATE_KEY_FILE:  /mnt/certificates/tls.key
      KC_PROXY:                       passthrough

</code></pre>
<p>Modifying the manifest (<a href="https://www.keycloak.org/operator/basic-deployment#_deploying_keycloak" rel="nofollow noreferrer">https://www.keycloak.org/operator/basic-deployment#_deploying_keycloak</a>) to replace <code>hostname: test.keycloak.org</code> with <code>hostname: localhost</code> <em>does</em> work. But how about for the other environment variables <code>KC_PROXY</code> and <code>PROXY_ADDRESS_FORWARDING</code>? Thank you</p>

Peter Becich
<p>You should use the <code>unsupported</code> resource property. For instance:</p>
<pre><code>apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
 ...
spec:
  unsupported:
    podTemplate:
      spec:
        containers:
          - name: keycloak
            env:
              - name: PROXY_ADDRESS_FORWARDING
                value: &quot;true&quot;
</code></pre>
<p>See <code>kubectl explain Keycloak.spec.unsupported.podTemplate</code></p>
<blockquote>
<pre><code>KIND:     Keycloak
VERSION:  k8s.keycloak.org/v2alpha1

RESOURCE: podTemplate &lt;Object&gt;

DESCRIPTION:
     You can configure that will be merged with the one configured by default by the operator. 
     ...
     
FIELDS:   
     metadata &lt;Object&gt;

     spec &lt;Object&gt;
</code></pre>
</blockquote>
