`hubctl keycloak apply`¶

Overview¶

hubctl keycloak apply updates Keycloak settings that are expected to match the current configuration of Altair SLC Hub. It checks the current values, shows any differences, and lets you confirm the changes before applying them - effectively acting like a reset for the Keycloak settings.

The command uses the Keycloak Admin API directly, so Keycloak is not restarted and Altair SLC Hub does not go offline.

Use it when Keycloak settings have been changed manually, when related URLs or hostnames have changed, or when you need to restore missing or incorrect client configuration without running a full hubctl bootstrap.

What it does¶

The command helps administrators safely reconcile Keycloak runtime configuration with the expected managed values.

The hubctl keycloak apply command:

compares current Keycloak runtime configuration with the expected values
shows the differences in a Terraform-like plan
warns about some suspicious or insecure values
asks for confirmation before applying changes
updates supported runtime-editable settings only

This provides a safe and targeted way to correct Keycloak runtime misconfiguration without re-running hubctl bootstrap.

Terraform-like view¶

Example output:

hubctl will perform the following apply actions on slchub-realm:

 ~ client "Portal" {
 ~   web_origins   = ["http://localhost:3000"] => ["+"]
 ~   redirect_uris = ["https://default-link.com/*"] => ["https://new-link.com/*"]
     ! Warning: Current Redirect URI does not match the recommended production pattern.
   }
 + client "Authorization" {
 +   Note: This client is missing and will be recreated with default settings.
   }

Plan: 1 to change, 1 to add, 0 to delete.
Do you want to perform these actions? (yes/no):

Example: recovering or correcting clients¶

For example, managed clients in the Keycloak Admin Portal under the relevant realm’s Clients section have IDs that begin with slchub, such as slchub-hubcli.

If one of these clients is deleted, you can recover it by running:

hubctl keycloak apply

If one of these clients is modified manually, the command can also detect configuration drift. For example, if you open slchub-hubcli and change URL-related settings in a way that is invalid or insecure, such as using http:// while HTTPS ingress is active, hubctl keycloak apply will flag the issue and indicate that the values need to be corrected.

When to use it¶

Use hubctl keycloak apply when:

a managed Keycloak client has been deleted and needs to be restored
a client setting has been changed manually and needs to be corrected
URL-related Keycloak settings need to be updated to match the current configuration
you want to review the proposed changes before they are applied
you want a confirmation step before making changes in a production-like environment
hubctl bootstrap reports that required Keycloak configuration has drifted

What it updates¶

This command only updates runtime-editable configuration managed through the Keycloak Admin API.

Current scope includes:

Setting	Notes
Web origins	Compared against expected values. Warnings may be shown for unsafe values such as `*`.
Redirect URIs	Compared against expected values. Warnings may be shown for insecure or invalid URLs, such as `http://` when HTTPS ingress is active.
Root URL	Compared against expected values.
Admin URL	Compared against expected values. Invalid or unreachable values may be flagged.
Clients	Missing managed clients can be detected and recreated.
Service accounts	Checks whether service accounts are enabled where required.

What it does not update¶

This command does not update:

settings from keycloak.conf
environment-variable or JVM-based Keycloak settings
configuration that requires a Keycloak restart
operationally sensitive settings such as LDAP configuration
realm settings such as password policy, OTP policy, token lifetimes, session timeouts, or SMTP settings

These settings are outside the scope of hubctl keycloak apply. Some require a Keycloak restart, while others are intentionally excluded because they are security- or operations-sensitive and are often managed separately.

How it differs from `hubctl bootstrap`¶

Use hubctl keycloak apply for targeted Keycloak runtime configuration fixes.

Use hubctl bootstrap for full installation or bootstrap-time configuration, including settings that require restart-time application.

This separation keeps hubctl keycloak apply safe to run on a live system, avoids unnecessary downtime, and makes its scope predictable.

hubctl keycloak apply¶