From 4a00042fa96ec23b16b3e157557a301b4604fc2e Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Fri, 10 Oct 2025 10:06:01 +0530
Subject: [PATCH 1/6] feat(RHIDP-9113): update configuration steps for rhbk
 installation

Signed-off-by: skestwal <skestwal@redhat.com>
---
 ci-scripts/rhdh-setup/create_resource.sh                  | 2 +-
 ci-scripts/rhdh-setup/deploy.sh                           | 4 ++--
 ci-scripts/rhdh-setup/template/keycloak/keycloak-op.yaml  | 8 ++++----
 ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml     | 4 ++--
 .../rhdh-setup/template/keycloak/keycloakClient.yaml      | 4 ++--
 .../rhdh-setup/template/keycloak/keycloakRealm.yaml       | 4 ++--
 ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml | 4 ++--
 7 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/ci-scripts/rhdh-setup/create_resource.sh b/ci-scripts/rhdh-setup/create_resource.sh
index c6316d5f..15d48bfb 100755
--- a/ci-scripts/rhdh-setup/create_resource.sh
+++ b/ci-scripts/rhdh-setup/create_resource.sh
@@ -588,7 +588,7 @@ get_token() {
         log_token_err "Unable to get $token_type token, re-attempting"
       fi
     else
-      keycloak_pass=$(oc -n "${RHDH_NAMESPACE}" get secret credential-rhdh-sso -o template --template='{{.data.ADMIN_PASSWORD}}' | base64 -d)
+      keycloak_pass=$(oc -n "${RHDH_NAMESPACE}" get secret credential-rhdh-keycloak -o template --template='{{.data.ADMIN_PASSWORD}}' | base64 -d)
       if ! keycloak_token "$keycloak_pass" >"$token_file"; then
         log_token_err "Unable to get $token_type token, re-attempting"
       fi
diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index a587fe2d..1bc3208b 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -234,8 +234,8 @@ keycloak_install() {
     )
     envsubst <template/keycloak/keycloak-op.yaml | $clin apply -f -
     envsubst <template/backstage/perf-test-secrets.yaml | $clin apply -f -
-    grep -m 1 "rhsso-operator" <($clin get pods -w)
-    wait_to_start deployment rhsso-operator 300 300
+    grep -m 1 "rhbk-operator" <($clin get pods -w)
+    wait_to_start deployment rhbk-operator 300 300
     envsubst <template/keycloak/keycloak.yaml | $clin apply -f -
     wait_to_start statefulset keycloak 450 600
     envsubst <template/keycloak/keycloakRealm.yaml | $clin apply -f -
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloak-op.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloak-op.yaml
index d225abf1..41a34ba4 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloak-op.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloak-op.yaml
@@ -1,7 +1,7 @@
 apiVersion: operators.coreos.com/v1
 kind: OperatorGroup
 metadata:
-  name: rhsso-operator-group
+  name: rhbk-operator-group
 spec:
   targetNamespaces:
     - ${RHDH_NAMESPACE}
@@ -9,10 +9,10 @@ spec:
 apiVersion: operators.coreos.com/v1alpha1
 kind: Subscription
 metadata:
-  name: rhsso-operator
+  name: rhbk-operator
 spec:
-  channel: stable
-  name: rhsso-operator
+  channel: stable-v26.2
+  name: rhbk-operator
   source: redhat-operators
   sourceNamespace: openshift-marketplace
   installPlanApproval: Automatic
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
index b1ff5c72..161310a7 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
@@ -1,9 +1,9 @@
 apiVersion: keycloak.org/v1alpha1
 kind: Keycloak
 metadata:
-  name: rhdh-sso
+  name: rhdh-keycloak
   labels:
-    app: sso
+    app: keycloak
 spec:
   instances: ${RHDH_KEYCLOAK_REPLICAS}
   externalAccess:
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
index ba47c607..22306032 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
@@ -3,7 +3,7 @@ kind: KeycloakClient
 metadata:
   name: backstage
   labels:
-    app: sso
+    app: keycloak
 spec:
   client:
     clientId: backstage
@@ -22,7 +22,7 @@ spec:
     standardFlowEnabled: true
   realmSelector:
     matchLabels:
-      app: sso
+      app: keycloak
   serviceAccountClientRoles:
     realm-management:
     - query-groups
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
index 78be5854..8997ced9 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
@@ -3,7 +3,7 @@ kind: KeycloakRealm
 metadata:
   name: backstage
   labels:
-    app: sso
+    app: keycloak
 spec:
   realm:
     id: "backstage"
@@ -12,4 +12,4 @@ spec:
     displayName: "Backstage Realm"
   instanceSelector:
     matchLabels:
-      app: sso
+      app: keycloak
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml
index 4254be85..f661b3d6 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml
@@ -3,11 +3,11 @@ kind: KeycloakUser
 metadata:
   name: guru
   labels:
-    app: sso
+    app: keycloak
 spec:
   realmSelector:
     matchLabels:
-      app: sso
+      app: keycloak
   user:
     username: guru
     firstName: Guru

From ba50067d72390731726cee0494d314ae1641a714 Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Mon, 13 Oct 2025 11:23:42 +0530
Subject: [PATCH 2/6] feat(RHIDP-9113): add single realm for clint and OAUTH2
 setup

Signed-off-by: skestwal <skestwal@redhat.com>
---
 ci-scripts/rhdh-setup/deploy.sh               |  6 +--
 .../template/keycloak/keycloak.yaml           | 15 +++++--
 .../template/keycloak/keycloakClient.yaml     | 30 -------------
 .../template/keycloak/keycloakRealm.yaml      | 15 -------
 .../keycloak/keycloakRealmImport.yaml         | 44 +++++++++++++++++++
 .../template/keycloak/keycloakUser.yaml       | 21 ---------
 6 files changed, 58 insertions(+), 73 deletions(-)
 delete mode 100644 ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
 delete mode 100644 ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
 create mode 100644 ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
 delete mode 100644 ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml

diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index 1bc3208b..459449a0 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -237,8 +237,7 @@ keycloak_install() {
     grep -m 1 "rhbk-operator" <($clin get pods -w)
     wait_to_start deployment rhbk-operator 300 300
     envsubst <template/keycloak/keycloak.yaml | $clin apply -f -
-    wait_to_start statefulset keycloak 450 600
-    envsubst <template/keycloak/keycloakRealm.yaml | $clin apply -f -
+    wait_to_start statefulset rhdh-keycloak 450 600
     if [ "$INSTALL_METHOD" == "helm" ]; then
         export OAUTH2_REDIRECT_URI="https://${RHDH_HELM_RELEASE_NAME}-developer-hub-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/oauth2/callback"
     elif [ "$INSTALL_METHOD" == "olm" ]; then
@@ -248,9 +247,8 @@ keycloak_install() {
             export OAUTH2_REDIRECT_URI="https://backstage-developer-hub-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/oauth2/callback"
         fi
     fi
-    envsubst <template/keycloak/keycloakClient.yaml | $clin apply -f -
     # shellcheck disable=SC2016
-    envsubst '${KEYCLOAK_USER_PASS}' <template/keycloak/keycloakUser.yaml | $clin apply -f -
+    envsubst '${KEYCLOAK_CLIENT_SECRET} ${OAUTH2_REDIRECT_URI} ${KEYCLOAK_USER_PASS}' <template/keycloak/keycloakRealmImport.yaml | $clin apply -f -
 }
 
 create_users_groups() {
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
index 161310a7..5816c228 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
@@ -1,4 +1,4 @@
-apiVersion: keycloak.org/v1alpha1
+apiVersion: k8s.keycloak.org/v2alpha1
 kind: Keycloak
 metadata:
   name: rhdh-keycloak
@@ -6,5 +6,14 @@ metadata:
     app: keycloak
 spec:
   instances: ${RHDH_KEYCLOAK_REPLICAS}
-  externalAccess:
-    enabled: True
+  hostname:
+    strict: false
+  http:
+    httpEnabled: true
+  ingress:
+    enabled: true
+  additionalOptions:
+    - name: hostname-strict
+      value: "false"
+    - name: http-enabled
+      value: "true"
\ No newline at end of file
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
deleted file mode 100644
index 22306032..00000000
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakClient.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-apiVersion: keycloak.org/v1alpha1
-kind: KeycloakClient
-metadata:
-  name: backstage
-  labels:
-    app: keycloak
-spec:
-  client:
-    clientId: backstage
-    secret: ${KEYCLOAK_CLIENT_SECRET}
-    clientAuthenticatorType: client-secret
-    defaultClientScopes:
-    - profile
-    - email
-    - roles
-    directAccessGrantsEnabled: true
-    implicitFlowEnabled: false
-    publicClient: false
-    redirectUris:
-      - ${OAUTH2_REDIRECT_URI}
-    serviceAccountsEnabled: true
-    standardFlowEnabled: true
-  realmSelector:
-    matchLabels:
-      app: keycloak
-  serviceAccountClientRoles:
-    realm-management:
-    - query-groups
-    - query-users
-    - view-users
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
deleted file mode 100644
index 8997ced9..00000000
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealm.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: keycloak.org/v1alpha1
-kind: KeycloakRealm
-metadata:
-  name: backstage
-  labels:
-    app: keycloak
-spec:
-  realm:
-    id: "backstage"
-    realm: "backstage"
-    enabled: True
-    displayName: "Backstage Realm"
-  instanceSelector:
-    matchLabels:
-      app: keycloak
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
new file mode 100644
index 00000000..bc798b99
--- /dev/null
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
@@ -0,0 +1,44 @@
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: KeycloakRealmImport
+metadata:
+  name: backstage-realm-import
+  labels:
+    app: keycloak
+spec:
+  keycloakCRName: rhdh-keycloak
+  realm:
+    id: "backstage"
+    realm: "backstage"
+    enabled: true
+    displayName: "Backstage Realm"
+    clients:
+      - clientId: backstage
+        secret: ${KEYCLOAK_CLIENT_SECRET}
+        clientAuthenticatorType: client-secret
+        defaultClientScopes:
+          - profile
+          - email
+          - roles
+        directAccessGrantsEnabled: true
+        implicitFlowEnabled: false
+        publicClient: false
+        redirectUris:
+          - ${OAUTH2_REDIRECT_URI}
+        serviceAccountsEnabled: true
+        standardFlowEnabled: true
+        serviceAccountClientRoles:
+          realm-management:
+            - query-groups
+            - query-users
+            - view-users
+    users:
+      - username: guru
+        firstName: Guru
+        lastName: RHDH Admin
+        email: guru@test.com
+        enabled: true
+        emailVerified: true
+        credentials:
+          - type: password
+            value: ${KEYCLOAK_USER_PASS}
+            temporary: false
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml
deleted file mode 100644
index f661b3d6..00000000
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakUser.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: keycloak.org/v1alpha1
-kind: KeycloakUser
-metadata:
-  name: guru
-  labels:
-    app: keycloak
-spec:
-  realmSelector:
-    matchLabels:
-      app: keycloak
-  user:
-    username: guru
-    firstName: Guru
-    lastName: RHDH Admin
-    email: guru@test.com
-    enabled: true
-    emailVerified: true
-    temporary: false
-    credentials:
-      - type: password
-        value: ${KEYCLOAK_USER_PASS}

From 8b39f578a5b1c4707a83f973f46c08e017278c2b Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Mon, 13 Oct 2025 14:16:53 +0530
Subject: [PATCH 3/6] feat(RHIDP-9113): generate generic secret
 keycloak-client-secret-backstage need for RHBK setup

Signed-off-by: skestwal <skestwal@redhat.com>
---
 ci-scripts/rhdh-setup/deploy.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index 459449a0..846d8723 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -249,6 +249,7 @@ keycloak_install() {
     fi
     # shellcheck disable=SC2016
     envsubst '${KEYCLOAK_CLIENT_SECRET} ${OAUTH2_REDIRECT_URI} ${KEYCLOAK_USER_PASS}' <template/keycloak/keycloakRealmImport.yaml | $clin apply -f -
+    $clin create secret generic keycloak-client-secret-backstage --from-literal=CLIENT_ID=backstage --from-literal=CLIENT_SECRET="$KEYCLOAK_CLIENT_SECRET" --dry-run=client -o yaml | oc apply -f -
 }
 
 create_users_groups() {

From 8054a6dc85c294884e5c2b1493202bf855520b6f Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Wed, 15 Oct 2025 13:21:38 +0530
Subject: [PATCH 4/6] feat(RHIDP-9113): add custom PostgreSQL StatefulSet for
 Keycloak

- Add dedicated PostgreSQL StatefulSet/Service/Secret for Keycloak

- Update deploy.sh to generate password and apply DB resources

- Prepare Keycloak to use external PostgreSQL instead of in-memory DB

Signed-off-by: skestwal <skestwal@redhat.com>
---
 ci-scripts/rhdh-setup/deploy.sh               |  18 +++
 .../keycloak/keycloak-postgresql.yaml         | 103 ++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 ci-scripts/rhdh-setup/template/keycloak/keycloak-postgresql.yaml

diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index 846d8723..083bddb3 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -236,8 +236,26 @@ keycloak_install() {
     envsubst <template/backstage/perf-test-secrets.yaml | $clin apply -f -
     grep -m 1 "rhbk-operator" <($clin get pods -w)
     wait_to_start deployment rhbk-operator 300 300
+
+    export KEYCLOAK_DB_PASSWORD
+    KEYCLOAK_DB_PASSWORD=$(mktemp -u XXXXXXXXXX)
+    export KEYCLOAK_DB_STORAGE
+    KEYCLOAK_DB_STORAGE=${KEYCLOAK_DB_STORAGE:-${RHDH_DB_STORAGE:-1Gi}}
+
+    log_info "Creating Keycloak PostgreSQL database with storage: $KEYCLOAK_DB_STORAGE"
+    envsubst <template/keycloak/keycloak-postgresql.yaml | $clin apply -f -
+    wait_to_start statefulset keycloak-postgresql 300 300
+
+    $clin create secret generic keycloak-db-user --from-literal=keycloak-db-user=keycloak --dry-run=client -o yaml | $clin apply -f -
+
     envsubst <template/keycloak/keycloak.yaml | $clin apply -f -
     wait_to_start statefulset rhdh-keycloak 450 600
+
+    $clin create route edge keycloak \
+        --service=rhdh-keycloak-service \
+        --port=8080 \
+        --dry-run=client -o yaml | $clin apply -f -
+
     if [ "$INSTALL_METHOD" == "helm" ]; then
         export OAUTH2_REDIRECT_URI="https://${RHDH_HELM_RELEASE_NAME}-developer-hub-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/oauth2/callback"
     elif [ "$INSTALL_METHOD" == "olm" ]; then
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloak-postgresql.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloak-postgresql.yaml
new file mode 100644
index 00000000..58663386
--- /dev/null
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloak-postgresql.yaml
@@ -0,0 +1,103 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloak-postgresql
+  labels:
+    app: keycloak-postgresql
+type: Opaque
+stringData:
+  postgres-password: ${KEYCLOAK_DB_PASSWORD}
+  password: ${KEYCLOAK_DB_PASSWORD}
+  replication-password: ${KEYCLOAK_DB_PASSWORD}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-postgresql
+  labels:
+    app: keycloak-postgresql
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: tcp-postgresql
+  selector:
+    app: keycloak-postgresql
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: keycloak-postgresql
+  labels:
+    app: keycloak-postgresql
+spec:
+  serviceName: keycloak-postgresql
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak-postgresql
+  template:
+    metadata:
+      labels:
+        app: keycloak-postgresql
+    spec:
+      containers:
+        - name: postgresql
+          image: registry.redhat.io/rhel9/postgresql-15:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: tcp-postgresql
+              containerPort: 5432
+          env:
+            - name: POSTGRESQL_USER
+              value: keycloak
+            - name: POSTGRESQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: keycloak-postgresql
+                  key: password
+            - name: POSTGRESQL_DATABASE
+              value: keycloak
+            - name: POSTGRESQL_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: keycloak-postgresql
+                  key: postgres-password
+            - name: PGDATA
+              value: /var/lib/pgsql/data/userdata
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/pgsql/data
+          livenessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U keycloak -d keycloak -h 127.0.0.1 -p 5432
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U keycloak -d keycloak -h 127.0.0.1 -p 5432
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: ${KEYCLOAK_DB_STORAGE}

From 60a58d633affb68e859e920d2a656ff799ce934f Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Tue, 28 Oct 2025 16:50:48 +0530
Subject: [PATCH 5/6] feat(RHIDP-9113): Update Keycloak configuration for Red
 Hat Build of Keycloak (RHBK):
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove /auth prefix from KEYCLOAK_BASE_URL endpoints
- Update OIDC issuer URLs: /auth/realms/ → /realms/
- Add PostgreSQL database configuration to Keycloak CR
- Configure bootstrap admin credentials and proxy headers
---
 ci-scripts/rhdh-setup/create_resource.sh      | 16 +++++++-------
 ci-scripts/rhdh-setup/deploy.sh               |  4 ++++
 .../helm/chart-values.image-override.yaml     |  2 +-
 .../template/backstage/helm/chart-values.yaml |  2 +-
 .../helm/oauth2-container-patch.yaml          |  2 +-
 .../template/backstage/olm/backstage.yaml     |  2 +-
 .../backstage/olm/rhdh-oauth2.deployment.yaml |  2 +-
 .../template/keycloak/keycloak.yaml           | 21 +++++++++++++++----
 8 files changed, 34 insertions(+), 17 deletions(-)

diff --git a/ci-scripts/rhdh-setup/create_resource.sh b/ci-scripts/rhdh-setup/create_resource.sh
index 15d48bfb..ce600b29 100755
--- a/ci-scripts/rhdh-setup/create_resource.sh
+++ b/ci-scripts/rhdh-setup/create_resource.sh
@@ -195,7 +195,7 @@ get_group_path_by_name() {
   local group_name="$input"
   token=$(get_token)
 
-  response=$(curl -s -k --location --request GET "$(keycloak_url)/auth/admin/realms/backstage/groups?search=${group_name}" \
+  response=$(curl -s -k --location --request GET "$(keycloak_url)/admin/realms/backstage/groups?search=${group_name}" \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $token" 2>&1)
 
@@ -221,7 +221,7 @@ get_group_id_by_name() {
   group_name="$1"
   token=$(get_token)
 
-  response=$(curl -s -k --location --request GET "$(keycloak_url)/auth/admin/realms/backstage/groups?search=${group_name}" \
+  response=$(curl -s -k --location --request GET "$(keycloak_url)/admin/realms/backstage/groups?search=${group_name}" \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $token" 2>&1)
   
@@ -269,7 +269,7 @@ assign_parent_group() {
   attempt=1
   while (( attempt <= max_attempts )); do
     token=$(get_token)
-    response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups/${parent_id}/children" \
+    response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups/${parent_id}/children" \
       -H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
       --data-raw '{"name":"'"${child_name}"'"}' 2>&1)"
     if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -296,7 +296,7 @@ create_group() {
       groupname="g${idx}"
       while ((attempt <= max_attempts)); do
         token=$(get_token)
-        response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups" \
+        response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups" \
           -H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
           --data-raw '{"name":"'"${groupname}"'"}' 2>&1)"
         if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -319,7 +319,7 @@ create_group() {
     groupname="g${idx}"
     while ((attempt <= max_attempts)); do
       token=$(get_token)
-      response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups" \
+      response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups" \
         -H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
         --data-raw '{"name":"'"${groupname}"'"}' 2>&1)"
       if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -444,7 +444,7 @@ create_user() {
   while ((attempt <= max_attempts)); do
     token=$(get_token)
     username="t${0}"
-    response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/users" \
+    response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/users" \
       -H 'Content-Type: application/json' \
       -H 'Authorization: Bearer '"$token" \
       --data-raw '{"firstName":"'"${username}"'","lastName":"tester", "email":"'"${username}"'@test.com","emailVerified":"true", "enabled":"true", "username":"'"${username}"'","groups":'"$groups"',"credentials":[{"type":"password","value":"'"${KEYCLOAK_USER_PASS}"'","temporary":false}]}' 2>&1)"
@@ -499,7 +499,7 @@ log_token_err() {
 }
 
 keycloak_token() {
-  curl -s -k "$(keycloak_url)/auth/realms/master/protocol/openid-connect/token" -d username=admin -d "password=$1" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
+  curl -s -k "$(keycloak_url)/realms/master/protocol/openid-connect/token" -d username=admin -d "password=$1" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
 }
 
 rhdh_token() {
@@ -526,7 +526,7 @@ rhdh_token() {
     --data-urlencode "redirect_uri=${REDIRECT_URL}" \
     --data-urlencode "scope=openid email profile" \
     --data-urlencode "response_type=code" \
-    "$(keycloak_url)/auth/realms/$REALM/protocol/openid-connect/auth" 2>&1| tee "$TMP_DIR/auth_url.log" | grep -oE 'action="[^"]+"' | grep -oE '"[^"]+"' | tr -d '"')
+    "$(keycloak_url)/realms/$REALM/protocol/openid-connect/auth" 2>&1| tee "$TMP_DIR/auth_url.log" | grep -oE 'action="[^"]+"' | grep -oE '"[^"]+"' | tr -d '"')
 
   execution=$(echo "$AUTH_URL" | grep -oE 'execution=[^&]+' | grep -oE '[^=]+$')
   tab_id=$(echo "$AUTH_URL" | grep -oE 'tab_id=[^&]+' | grep -oE '[^=]+$')
diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index 083bddb3..033cdc80 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -251,6 +251,10 @@ keycloak_install() {
     envsubst <template/keycloak/keycloak.yaml | $clin apply -f -
     wait_to_start statefulset rhdh-keycloak 450 600
 
+    $clin create secret generic credential-rhdh-keycloak \
+        --from-literal=ADMIN_PASSWORD=admin \
+        --dry-run=client -o yaml | $clin apply -f -
+
     $clin create route edge keycloak \
         --service=rhdh-keycloak-service \
         --port=8080 \
diff --git a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
index 8739b663..a741e92d 100644
--- a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
@@ -57,7 +57,7 @@ upstream:
             key: github.token
             name: "{{ .Release.Name }}-plugin-secrets"
       - name: KEYCLOAK_BASE_URL
-        value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
+        value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
       - name: KEYCLOAK_LOGIN_REALM
         value: "backstage"
       - name: KEYCLOAK_REALM
diff --git a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
index 8ed14b4d..fddb0047 100644
--- a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
@@ -57,7 +57,7 @@ upstream:
             key: github.token
             name: "{{ .Release.Name }}-plugin-secrets"
       - name: KEYCLOAK_BASE_URL
-        value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
+        value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
       - name: KEYCLOAK_LOGIN_REALM
         value: "backstage"
       - name: KEYCLOAK_REALM
diff --git a/ci-scripts/rhdh-setup/template/backstage/helm/oauth2-container-patch.yaml b/ci-scripts/rhdh-setup/template/backstage/helm/oauth2-container-patch.yaml
index 9e47f850..7113da1e 100644
--- a/ci-scripts/rhdh-setup/template/backstage/helm/oauth2-container-patch.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/helm/oauth2-container-patch.yaml
@@ -18,7 +18,7 @@ extraContainers:
             key: keycloak_cookie_secret
             name: perf-test-secrets
       - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-        value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth/realms/backstage
+        value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/realms/backstage
       - name: OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY
         value: "true"
       - name: OAUTH2_PROXY_LOGGING_LEVEL
diff --git a/ci-scripts/rhdh-setup/template/backstage/olm/backstage.yaml b/ci-scripts/rhdh-setup/template/backstage/olm/backstage.yaml
index 904ab1f2..e4aa9514 100644
--- a/ci-scripts/rhdh-setup/template/backstage/olm/backstage.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/olm/backstage.yaml
@@ -18,7 +18,7 @@ spec:
     extraEnvs:
       envs:
         - name: KEYCLOAK_BASE_URL
-          value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
+          value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
         - name: KEYCLOAK_LOGIN_REALM
           value: "backstage"
         - name: KEYCLOAK_REALM
diff --git a/ci-scripts/rhdh-setup/template/backstage/olm/rhdh-oauth2.deployment.yaml b/ci-scripts/rhdh-setup/template/backstage/olm/rhdh-oauth2.deployment.yaml
index c5f7208b..39b4dd4b 100644
--- a/ci-scripts/rhdh-setup/template/backstage/olm/rhdh-oauth2.deployment.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/olm/rhdh-oauth2.deployment.yaml
@@ -40,7 +40,7 @@ spec:
                   key: keycloak_cookie_secret
                   name: perf-test-secrets
             - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-              value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth/realms/backstage
+              value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/realms/backstage
             - name: OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY
               value: "true"
           image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
index 5816c228..0657f113 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml
@@ -6,6 +6,17 @@ metadata:
     app: keycloak
 spec:
   instances: ${RHDH_KEYCLOAK_REPLICAS}
+  db:
+    vendor: postgres
+    host: keycloak-postgresql
+    port: 5432
+    database: keycloak
+    usernameSecret:
+      name: keycloak-db-user
+      key: keycloak-db-user
+    passwordSecret:
+      name: keycloak-postgresql
+      key: password
   hostname:
     strict: false
   http:
@@ -13,7 +24,9 @@ spec:
   ingress:
     enabled: true
   additionalOptions:
-    - name: hostname-strict
-      value: "false"
-    - name: http-enabled
-      value: "true"
\ No newline at end of file
+    - name: bootstrap-admin-username
+      value: admin
+    - name: bootstrap-admin-password
+      value: admin
+    - name: proxy-headers
+      value: forwarded
\ No newline at end of file

From f4695d22f39c0c4d953ef7babd71b3826ea75319 Mon Sep 17 00:00:00 2001
From: skestwal <skestwal@redhat.com>
Date: Fri, 31 Oct 2025 14:53:08 +0530
Subject: [PATCH 6/6]  feat(RHIDP-9113): add username change for validation \
 creadentail changes for new database of keycloak \ additional config to sync
 the catalog to RHDH

Signed-off-by: skestwal <skestwal@redhat.com>
---
 ci-scripts/rhdh-setup/create_resource.sh      | 12 +++++++++---
 ci-scripts/rhdh-setup/deploy.sh               |  5 +++--
 .../helm/chart-values.image-override.yaml     | 19 +++++++++++++++++++
 .../template/backstage/helm/chart-values.yaml | 19 +++++++++++++++++++
 .../keycloak/keycloakRealmImport.yaml         |  7 +++++++
 5 files changed, 57 insertions(+), 5 deletions(-)

diff --git a/ci-scripts/rhdh-setup/create_resource.sh b/ci-scripts/rhdh-setup/create_resource.sh
index ce600b29..dfca49f7 100755
--- a/ci-scripts/rhdh-setup/create_resource.sh
+++ b/ci-scripts/rhdh-setup/create_resource.sh
@@ -443,7 +443,7 @@ create_user() {
   groups="$groups]"
   while ((attempt <= max_attempts)); do
     token=$(get_token)
-    username="t${0}"
+    username="t_${0}"
     response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/users" \
       -H 'Content-Type: application/json' \
       -H 'Authorization: Bearer '"$token" \
@@ -499,7 +499,13 @@ log_token_err() {
 }
 
 keycloak_token() {
-  curl -s -k "$(keycloak_url)/realms/master/protocol/openid-connect/token" -d username=admin -d "password=$1" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
+  client_secret=$(oc -n "${RHDH_NAMESPACE}" get secret keycloak-client-secret-backstage -o template --template='{{.data.CLIENT_SECRET}}' | base64 -d)
+  curl -s -k "$(keycloak_url)/realms/backstage/protocol/openid-connect/token" \
+    -d username=guru \
+    -d "password=$1" \
+    -d 'grant_type=password' \
+    -d 'client_id=backstage' \
+    -d "client_secret=$client_secret" | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
 }
 
 rhdh_token() {
@@ -588,7 +594,7 @@ get_token() {
         log_token_err "Unable to get $token_type token, re-attempting"
       fi
     else
-      keycloak_pass=$(oc -n "${RHDH_NAMESPACE}" get secret credential-rhdh-keycloak -o template --template='{{.data.ADMIN_PASSWORD}}' | base64 -d)
+      keycloak_pass=$(oc -n "${RHDH_NAMESPACE}" get secret perf-test-secrets -o template --template='{{.data.keycloak_user_pass}}' | base64 -d)
       if ! keycloak_token "$keycloak_pass" >"$token_file"; then
         log_token_err "Unable to get $token_type token, re-attempting"
       fi
diff --git a/ci-scripts/rhdh-setup/deploy.sh b/ci-scripts/rhdh-setup/deploy.sh
index 033cdc80..cdb08982 100755
--- a/ci-scripts/rhdh-setup/deploy.sh
+++ b/ci-scripts/rhdh-setup/deploy.sh
@@ -61,6 +61,7 @@ export GROUP_COUNT="${GROUP_COUNT:-1}"
 export API_COUNT="${API_COUNT:-1}"
 export COMPONENT_COUNT="${COMPONENT_COUNT:-1}"
 export KEYCLOAK_USER_PASS=${KEYCLOAK_USER_PASS:-$(mktemp -u XXXXXXXXXX)}
+export KEYCLOAK_ADMIN_PASS=${KEYCLOAK_ADMIN_PASS:-admin}
 export AUTH_PROVIDER="${AUTH_PROVIDER:-''}"
 export ENABLE_RBAC="${ENABLE_RBAC:-false}"
 export ENABLE_ORCHESTRATOR="${ENABLE_ORCHESTRATOR:-false}"
@@ -252,7 +253,7 @@ keycloak_install() {
     wait_to_start statefulset rhdh-keycloak 450 600
 
     $clin create secret generic credential-rhdh-keycloak \
-        --from-literal=ADMIN_PASSWORD=admin \
+        --from-literal=ADMIN_PASSWORD="$KEYCLOAK_ADMIN_PASS" \
         --dry-run=client -o yaml | $clin apply -f -
 
     $clin create route edge keycloak \
@@ -270,7 +271,7 @@ keycloak_install() {
         fi
     fi
     # shellcheck disable=SC2016
-    envsubst '${KEYCLOAK_CLIENT_SECRET} ${OAUTH2_REDIRECT_URI} ${KEYCLOAK_USER_PASS}' <template/keycloak/keycloakRealmImport.yaml | $clin apply -f -
+    envsubst '${KEYCLOAK_CLIENT_SECRET} ${OAUTH2_REDIRECT_URI} ${KEYCLOAK_USER_PASS} ${KEYCLOAK_ADMIN_PASS}' <template/keycloak/keycloakRealmImport.yaml | $clin apply -f -
     $clin create secret generic keycloak-client-secret-backstage --from-literal=CLIENT_ID=backstage --from-literal=CLIENT_SECRET="$KEYCLOAK_CLIENT_SECRET" --dry-run=client -o yaml | oc apply -f -
 }
 
diff --git a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
index a741e92d..af676101 100644
--- a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml
@@ -8,6 +8,25 @@ global:
     plugins:
       - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic
         disabled: false
+        pluginConfig:
+          catalog:
+            providers:
+              keycloakOrg:
+                default:
+                  baseUrl: ${KEYCLOAK_BASE_URL}
+                  realm: ${KEYCLOAK_REALM}
+                  loginRealm: ${KEYCLOAK_LOGIN_REALM}
+                  clientId: ${CLIENT_ID}
+                  clientSecret: ${CLIENT_SECRET}
+                  userQuerySize: 1000
+                  groupQuerySize: 1000
+                  schedule:
+                    frequency:
+                      minutes: 30
+                    timeout:
+                      minutes: 1
+                    initialDelay:
+                      seconds: 15
       - package: ./dynamic-plugins/dist/backstage-community-plugin-analytics-provider-segment
         disabled: true
       # TechDocs
diff --git a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
index fddb0047..9bb8f2cf 100644
--- a/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
+++ b/ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml
@@ -8,6 +8,25 @@ global:
     plugins:
       - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic
         disabled: false
+        pluginConfig:
+          catalog:
+            providers:
+              keycloakOrg:
+                default:
+                  baseUrl: ${KEYCLOAK_BASE_URL}
+                  realm: ${KEYCLOAK_REALM}
+                  loginRealm: ${KEYCLOAK_LOGIN_REALM}
+                  clientId: ${CLIENT_ID}
+                  clientSecret: ${CLIENT_SECRET}
+                  userQuerySize: 1000
+                  groupQuerySize: 1000
+                  schedule:
+                    frequency:
+                      minutes: 30
+                    timeout:
+                      minutes: 1
+                    initialDelay:
+                      seconds: 15
       - package: ./dynamic-plugins/dist/backstage-community-plugin-analytics-provider-segment
         disabled: true
       # TechDocs
diff --git a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
index bc798b99..fe5bc67c 100644
--- a/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
+++ b/ci-scripts/rhdh-setup/template/keycloak/keycloakRealmImport.yaml
@@ -31,6 +31,10 @@ spec:
             - query-groups
             - query-users
             - view-users
+            - view-clients
+            - view-realm
+            - manage-users
+            - manage-clients
     users:
       - username: guru
         firstName: Guru
@@ -42,3 +46,6 @@ spec:
           - type: password
             value: ${KEYCLOAK_USER_PASS}
             temporary: false
+        clientRoles:
+          realm-management:
+            - realm-admin