Meet Keycloak at KubeCon EU, Amsterdam in March 2026

Keycloak serves as a central hub for managing human and machine identities across sovereign cloud-native architectures using OpenID Connect, SAML, and trust brokering. This talk shows how to implement strong authentication, use the latest OpenTelemetry features, and leverage Kubernetes service accounts to authenticate clients.

Traditional VPNs often grant excessive network access once a user is "inside," whereas reverse proxies provide a more secure, granular approach by verifying identity for every specific resource. This session will use a demo featuring Envoy and Keycloak to illustrate how reverse proxies enforce precise authorization and logging for modern, cloud-native systems.

This session explores federated identity patterns designed to solve the complexity of propagating authorization across multi-cluster Kubernetes environments. By combining SPIFFE JWT SVIDs with emerging OAuth Identity Chaining and assertion frameworks, the talk shows how to achieve secure, multi-hop identity propagation without relying on static credentials. Attendees will see a practical integration of Keycloak and SPIRE that enhances interoperability and security in dynamic cloud-native architectures.

This session addresses the security risks of anonymous AI actions by introducing an architecture that cryptographically links agent identity with delegated user identity. By combining SPIRE for workload attestation, Keycloak for managing user context, and an MCP Gateway for policy enforcement, the framework ensures every action is fully traceable. Attendees will learn how to move beyond static API keys to create a verifiable audit trail for both the executing code and the authorizing user.