Skip to content

ADR-006-keycloak-per-environment.md

Latest commit

 

History

History
32 lines (20 loc) · 887 Bytes

ADR-006-keycloak-per-environment.md

File metadata and controls

32 lines (20 loc) · 887 Bytes

ADR-006: Keycloak per Environment vs Centralized

Status: Accepted

Date: 2026-01-25

Context

Decide whether Keycloak should be shared between environments or isolated.

Decision

Keycloak per environment (isolated). Each AWS account (HML, PRD) has its own Keycloak instances with separate configurations in Git.

Rationale

  • Data isolation between HML and Prod
  • Allows testing configuration changes in HML
  • Avoids cross-account dependency
  • Reduced blast radius
  • Progressive rollout (HML → PRD with approval)

Consequences

  • Multiple instances to manage
  • Separate configurations per account in platform-keycloak/realms/{account}/
  • Promotion from HML to PRD via Pull Request (see ADR-010)
  • Synchronization only cross-region within the same account (GitOps)

References

  • ADR-010: Keycloak Multi-Region with GitOps Sync (implementation details)