HankoShell Academy · Path 01
From YAML to Keycloak.
Your turn.
A real operator, a test Keycloak and a Kubernetes cluster prepared for you. Execute the commands and compare your declarations with actual provider state.
- About 20 minutes
- No local installation
- Free Killercoda account required
Three journeys. Verifiable results.
01
Declare an OIDC client
Apply a manifest and inspect the client created in Keycloak. Change its callback and verify reconciliation without a UUID change.
02
Adopt an existing client
Observe without changing it, review the candidate, approve its exact hash and explicitly enable Manage mode.
03
Authenticate a machine
Declare a service account and use its projected Secret to obtain a real OAuth client_credentials token.
Before you start
The walkthrough is in English. Your environment starts when you open the lab; image downloads may take a few minutes. Wait for Ready before the first step. Free sessions last up to one hour and are then disposed of.
Use only the synthetic lab data. Do not enter real secrets or connect an existing cluster.
A trial with a clear scope
Operator 1.0.0 and Keycloak 26.8.1, with images and chart pinned by digest. Checks cover configuration and machine authentication. The lab does not deploy a web application, test browser SSO or qualify high availability.
Kubernetes APIs remain experimental: hanko.sh/v1alpha1. For your own environment, review permissions, compatibility and upgrade procedures.
Continue with the documentation