= Keycloak User Custom Resource

The Keycloak Operator allows application developers to represent Keycloak Users as Custom Resources:

.`KeycloakUser` Custom Resource
```yaml
apiVersion: keycloak.org/v1alpha1
kind: KeycloakUser
metadata:
  name: example-realm-user
spec:
  user:
    username: "realm_user"
    firstName: "John"
    lastName: "Doe"
    email: "user@example.com"
    enabled: True
    emailVerified: False
    realmRoles:
      - "offline_access"
    clientRoles:
      account:
        - "manage-account"
      realm-management:
        - "manage-users"
  realmSelector:
    matchLabels:
      app: sso
```

TIP: Note, that `realmSelector` needs to match labels of an existing `KeycloakRealm` Custom Resource.

The Operator synchronizes all the changes made to the Custom Resource with a running Keycloak instance. No
manual changes via Keycloak Admin Console are allowed.

Once the Operator reconciles the Custom Resource, it reports the status back:

.`KeycloakUser` Custom Resource Status
```yaml
Name:         example-realm-user
Namespace:    keycloak
Labels:       app=sso
API Version:  keycloak.org/v1alpha1
Kind:         KeycloakUser
Spec:
  Realm Selector:
    Match Labels:
      App:  sso
  User:
    Email:           realm_user@redhat.com
    Credentials:
      Type:          password
      Value:         <user password>
    Email Verified:  false
    Enabled:         true
    First Name:      John
    Last Name:       Doe
    Username:        realm_user
Status:
  Message:
  Phase:    reconciled
Events:     <none>
```

Once a User is created, the Operator creates a Secret with the user credentials using the
following naming pattern: `credential-<realm name>-<user name>-<namespace>`. Here's an example:

.`KeycloakUser`'s Secret
```
kind: Secret
apiVersion: v1
data:
  password: <base64 encoded password>
  username: <base64 encoded username>
type: Opaque```
