Identity for the private cloud.
One intent. One console. Keycloak + HA Postgres that actually ship together.
Copyright © 2026 Zyvor AI Labs. Licensed under the Apache License 2.0. See NOTICE.
The official Keycloak Operator runs Keycloak well. It does not manage the database. That gap is where production identity dies — not application data pipelines.
| Pain | What teams actually do | What Haven does |
|---|---|---|
| Database is “bring your own” | Bitnami chart, random StatefulSet, forgotten RDS URL | CloudNativePG cluster owned by the same plane |
| Secrets are tribal knowledge | kubectl create secret in Slack |
Generated, rotated, referenced automatically |
| First-boot is a scavenger hunt | Hunt -initial-admin, guess hostname, fight TLS |
Wizard + ready URL + operator bootstrap secret |
| Day-2 is two UIs and a prayer | kubectl + Keycloak admin, no backup story | One console: plane health, DB, realms, clients, backups |
| Multi-tenant private cloud | One Keycloak, many undocumented realms | Realms as first-class tenants with platform OIDC clients |
Haven composes official CloudNativePG and the official Keycloak Operator. No forks. No custom Keycloak image required for v0.
Haven is a small, open-source (Apache-2.0) packaging/operations layer over the official Keycloak Operator and CloudNativePG — it is not a replacement identity provider, not a managed SaaS IdP, and not a Keycloak fork.
| Haven | Plain Keycloak Operator | Auth0 / Okta | Authentik | Zitadel | AWS Cognito | |
|---|---|---|---|---|---|---|
| Primary scope | Keycloak + HA Postgres shipped/operated as one plane | Keycloak lifecycle only — you bring your own database | Managed cloud IdP | Self-hosted IdP (own identity engine) | Self-hosted IdP (own identity engine) | Managed cloud IdP (AWS-tied) |
| Database included | Yes — CloudNativePG, owned by the same plane | No — "bring your own," a real documented gap | N/A (managed) | You bring your own | You bring your own | N/A (managed) |
| Self-hosted / private cloud | Yes | Yes | No | Yes | Yes | No |
| License | Apache-2.0 | Apache-2.0 (Keycloak itself) | Proprietary | Apache-2.0/AGPL depending on component | Apache-2.0 core + commercial | Proprietary |
| Identity engine | Keycloak (official, unmodified) | Keycloak (official, unmodified) | Proprietary | Custom | Custom | Custom |
(General characterizations as of writing — verify current features against each project's own docs.)
Maturity, stated honestly: docs/roadmap.md frames
the current repository as "v0" — compose overlays, CLI, and CRDs are
defined, but the Helm chart today "installs RBAC only (controller/console
images unpublished)." The full Kubebuilder reconcile loop is v1,
"in progress." docs/production-overlay.md
describes itself as "a shape, not a one-command install." Only one tagged
release exists, 0.1.0.
New here? docs/faq.md covers licensing, support, and
production-readiness questions; docs/troubleshooting.md
covers real operational issues with their documented fix.
IdentityPlane— one CR for Postgres + Keycloak + certs + ingress (controller path in v1)- Compose today —
deploy/overlays/{dev,prod}are the exact manifests the controller will render - Command Deck — live plane + Keycloak health in one glass
- Realm Studio — realms, users, clients, IdPs without living in the Keycloak admin UI
- CLI —
deploy,status,doctor,admin,backup - Private-cloud defaults — NetworkPolicies, TLS, metrics on in
production
you ──► IdentityPlane CR ──► Haven controller (v1)
│
┌──────────────┼──────────────┐
▼ ▼ ▼
CloudNativePG Keycloak CR Certs + Gateway
(HA Postgres) (official op) (cert-manager)
v0 compose path: deploy/overlays/{dev,prod} (no controller required)
Haven is the identity plane: deploy and operate Keycloak + PostgreSQL (CloudNativePG) — CRDs, console, and CLI for realms, OIDC clients, and day-2 ops.
Haven is not an AI agent, app-data quality tool, conflict resolver, or human-in-the-loop verifier for automation over user databases. The Postgres cluster it owns is Keycloak’s store, not your app OLTP.
Inspired by Zeus OS / Zyvor private-cloud UX. Keycloak stays the IAM engine. Haven is the plane that deploys and operates it.
Pinned versions live in versions.env.
# 1. Operators (once per cluster)
./deploy/operators/install.sh
# 2. Postgres + Keycloak
make dev
make wait
make doctor
make admin| Keycloak Admin | http://auth.127.0.0.1.nip.io/admin |
| Bootstrap secret | platform-initial-admin in namespace identity |
| First realm | make realm-import (optional) |
Remote lab console
./scripts/deploy-remote.sh <ephemeral-ip> operatorOpen http://<ephemeral-ip>:30742/login — endpoints in docs/lab-host.md.
UI local
make ui-install # once
make ui-dev # http://localhost:5173Served by haven-console (Go API + embedded SPA in ui/web/).
| Route | What |
|---|---|
/deck |
Command Deck — live plane + Keycloak health |
/planes |
IdentityPlane fleet |
/atlas |
Topology: Console → Ingress → Keycloak → Postgres |
/realms |
Realm Studio (users, clients, IdPs, events) |
/clients |
Cross-realm OIDC clients |
/deploy |
Deploy wizard |
/settings |
Keycloak connect, theme, password changes |
Session required. Details: docs/console.md.
helm install haven oci://ghcr.io/zyvorai/charts/haven --version 0.1.0 \
--set controller.enabled=true \
--set console.enabled=trueImages:
ghcr.io/zyvorai/haven-console:0.1.0
ghcr.io/zyvorai/haven-controller:0.1.0
Controller and console default to enabled: false until you opt in. Chart installs RBAC by default.
deploy/overlays/prod is a shape, not a one-liner. Read docs/production-overlay.md before apply:
./hack/gen-prod-secrets.sh— do not use the placeholder password- Wait for CNPG, then
./hack/sync-cnpg-ca.sh(Keycloak verifies DB TLS) - Issue
platform-tlsfrom your ClusterIssuer - Configure backups separately (backups guide)
| Surface | Who | What |
|---|---|---|
| Command Deck | Platform owners | Live plane health, Keycloak status, reconcile |
| Planes / Atlas | Platform owners | Fleet list + topology map |
| Realm Studio | Tenant admins | Realms, users, clients, IdPs |
| Settings | Operators | Keycloak connect, console + admin passwords |
CLI haven |
SRE / GitOps | deploy, status, doctor, admin, backup |
| CRDs | Controllers | IdentityPlane, RealmBundle, OidcClient |
- One object, two runtimes. Database and Keycloak share a lifecycle. Default
reclaimPolicy: Orphanso deleting a plane does not drop IAM data. - Operators stay official. Haven composes CloudNativePG and the Keycloak Operator — it does not fork them.
- Secrets never leave the cluster. Operator bootstrap secret is the source of truth in v0.
- Git is optional, not mandatory. The console can write CRs; Flux/Argo can own the same CRs.
- Private-cloud defaults. NetworkPolicies on, TLS on, metrics on in
production. - Identity is a platform service. First realm can mint OIDC clients for Kubernetes API, Grafana, Argo CD, Zeus OS.
Published: zyvorai.github.io/haven · full index in docs/README.md
| Doc | When to read |
|---|---|
| FAQ | Deciding whether to adopt Haven |
| Troubleshooting | Real operational issues, with the fix |
| Getting started | First deploy (local, lab, or prod) |
| Runbook | Install, day-2 ops, troubleshooting |
| Lab host | Console + Keycloak on a remote host |
| Console | Auth, routes, remote deploy |
| Tutorials | Realm, client, and password recipes |
| CLI | ./cli/haven and Makefile targets |
| Architecture | CRDs, reconcile order, profiles |
| Roadmap | v0 / v1 / v2 scope |
make docs-serveContributing: CONTRIBUTING.md · docs/contributing.md · Security: SECURITY.md · Code of Conduct: CODE_OF_CONDUCT.md
This repository is licensed under the Apache License, Version 2.0. You may use, modify, and run it for personal, lab, and commercial production use at no charge, subject to Apache-2.0 (preserve notices / NOTICE where required). See NOTICE for third-party attribution (Keycloak and CloudNativePG remain under their own licenses).
Production support, SLAs, and Zyvor Enterprise products are licensed separately. Contact sales@zyvor.dev or see zyvor.dev.