Review: Import Keycloak realms/clients into Terraform

Verdict: READY

Template Completeness

• [x] Lineage — present, traces to plan-pal-e-platform → Phase 28
• [x] Repo — present, correctly identifies forgejo_admin/pal-e-services
• [x] User Story — present, well-formed As/Want/So-that
• [x] Context — present, thorough background including current state inventory and import UUIDs
• [x] File Targets — present, lists files to create, modify, and NOT touch
• [x] Acceptance Criteria — present, 8 checkboxes, all verifiable
• [x] Test Expectations — present, includes run command
• [x] Constraints — present, 5 constraints including the critical no-apply-until-zero-diff gate
• [x] Checklist — present
• [x] Related — present, links to plan, phase, parent issue, spec

File Targets

• [x] terraform/keycloak.tf — to create. Confirmed does not exist yet in pal-e-services. Clean slate.
• [x] terraform/keycloak-import.sh — to create. Confirmed does not exist yet.
• [x] terraform/versions.tf — to modify. Verified: exists, contains required_providers block with kubernetes, helm, harbor, argocd. Adding keycloak follows the exact same pattern.
• [x] terraform/providers.tf — to modify. Verified: exists, contains ArgoCD provider with identical plan-time-dependency pattern. Keycloak provider follows the same structure.
• [x] terraform/variables.tf — to modify. Verified: exists, currently declares harbor_admin_password, argocd_admin_password, forgejo_argocd_token, services. Adding keycloak_admin_password + keycloak_realms + keycloak_clients follows the established pattern.
• [x] terraform/k3s.tfvars — to modify. Verified: exists, contains credential values and services map.
• [x] terraform/services.tf — NOT to touch. Confirmed: no keycloak references exist in this file. Correct exclusion.
• [x] terraform/main.tf — NOT to touch. Confirmed: this is pal-e-services main.tf (ArgoCD/Image Updater config). Keycloak server lives in pal-e-platform, not here.

Repo Placement

Dependencies

• Keycloak server deployed — verified running in pal-e-platform (Keycloak 26.0.7, quay.io/keycloak/keycloak:26.0.7). The provider connects at plan time, so Keycloak must be up.
• Admin password in pillar — PR #141 merged per phase note. keycloak_admin_password already exists in pal-e-platform's variables.tf. The pal-e-services copy will be a new variable sourced from the same credential.
• Theme files mounted — PR #130 merged per phase note. Verified: westside theme ConfigMap exists in pal-e-platform's main.tf.
• Board item #278 (issue #24) — sibling ticket for SOP update, labeled depends:23. Correctly sequenced: docs update waits for implementation.
• Board item #270 (issue #142) — parent tracking issue on pal-e-platform board. In backlog. No blocker.
• No items in in_progress block this work — the active items (#188 platform cleanup, #176 network recovery, #170 cnpg-metrics) are independent of Keycloak Terraform onboarding.

Acceptance Criteria

• [x] tofu plan zero changes — directly testable via CLI
• [x] 63 westside users can still log in — requires manual smoke test (correctly noted in test expectations)
• [x] lifecycle ignore_changes on client_secret — verifiable by reading generated HCL
• [x] lifecycle ignore_changes on default client scopes — verifiable by reading generated HCL
• [x] Protocol mapper preserved — verifiable via tofu plan + Keycloak API
• [x] Custom roles declared — verifiable by reading generated HCL and plan output
• [x] registrationEmailAsUsername per realm — verifiable by reading generated HCL
• [x] PKCE S256 on westside-spa and mcd-tracker-ios — verifiable by reading generated HCL

Blast Radius

• Existing services unaffected: The ticket explicitly excludes services.tf and main.tf. Keycloak provider resources are additive — no existing Terraform resources are modified.
• No similar pattern gap elsewhere: This is the first Keycloak Terraform integration. No sibling services have unmanaged Keycloak config that would need the same treatment (all Keycloak realms/clients are covered by this ticket).
• Master realm excluded: Correctly scoped — admin realm lockout risk is acknowledged and mitigated by exclusion.
• Pre-existing tfvars drift: k3s.tfvars contains sops_age_private_key and source_repo/source_path attributes in the services map that are not declared in variables.tf. This is NOT this ticket's concern, but the agent should be aware that tofu plan may behave unexpectedly with undeclared variables. This should not block the ticket.
• Provider version compatibility: Ticket specifies mrparkers/keycloak ~>5.0 with Keycloak 26.0.7. The spec notes this needs verification. The constraint in the ticket ("Verify mrparkers/keycloak v5.x works with Keycloak 26.0.7") is appropriate — the agent should verify during implementation.

Recommendation