Skip to content

First-Time Setup: Keycloak SSO & Administrator Initialization

Once the cluster is running, configure Keycloak to establish enterprise identity and create the first administrator.

Step 1: Access Keycloak Admin Console

If Keycloak is not yet routed through an external Ingress, establish a local port-forward:

kubectl port-forward svc/keycloak 8081:8080 -n vda

Open http://localhost:8081 in your browser and log in with your administrative credentials (KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD from your Secret).

Step 2: Create Realm & OpenID Connect Client

  1. Click Create Realm and enter vda.
  2. Under Clients > Create client:
  3. Client type: OpenID Connect
  4. Client ID: vda-client
  5. Valid redirect URIs: https://vda.company.internal/* (or http://localhost:8080/* for staging)
  6. Web origins: *
  7. Click Save.

Step 3: Define Realm Roles & Assign Superadmin

  1. Navigate to Realm roles > Create role:
  2. Add SUPERADMIN
  3. Add DATA_CONSUMER
  4. Add DATA_STEWARD
  5. Navigate to Users > Add user:
  6. Create user vda-admin
  7. Under Credentials, set a permanent password (toggle Temporary off).
  8. Under Role mapping, assign the SUPERADMIN role.