kaji is a blazing-fast, declarative CLI that brings GitOps discipline to your Keycloak identity infrastructure — inspect, plan, apply, drift-detect, and sleep soundly at night.
$ kaji plan --interactive
// Calculating diff for realm 'master'...
Clients:
[+] my-new-app Create
[~] admin-cli Update
root_url: "http://localhost" → "https://idp.example.com"
[-] legacy-app Delete
Roles:
[+] billing-manager Create
? Apply change to client 'my-new-app'? █Stop clicking through the admin UI. Define your desired state, let kaji calculate the diff, and apply with full confidence.
Define your entire Keycloak realm — clients, roles, users, flows — as human-readable YAML files. Commit them to Git, review in PRs, roll back with git revert.
clientId: internal-api
enabled: true
redirectUris:
- "https://api.example.com/*"
secret: ${KEYCLOAK_CLIENT_INTERNAL_API_SECRET}kaji applies changes in the right order — Realms first, then Roles and IdPs, then Clients and Flows, finally Users and Keys. No race conditions.
One base configuration, zero duplication. Override only what differs per environment via YAML deep-merge overlays.
Is your live Keycloak still matching your declared config? Run kaji drift to instantly know what changed outside your controlled process.
Inspect auto-masks sensitive values. Resolve them from environment variables or directly from HashiCorp Vault KV2 — no secret ever touches your repo.
Built on Tokio with full concurrency. Independent resources are inspected and reconciled in parallel via JoinSet.
Catch errors before they hit Keycloak. kaji dry-runs your local configuration to validate references, schemas, and credentials.
curl -LsSf https://raw.githubusercontent.com/ffalcinelli/kaji/main/scripts/install.sh | shpowershell -c "irm https://raw.githubusercontent.com/ffalcinelli/kaji/main/scripts/install.ps1 | iex"git clone https://github.com/ffalcinelli/kaji.git
cd kaji
cargo build --release
sudo cp target/release/kaji /usr/local/bin/Requires Rust 1.85+ when building from source.
kaji inspect
Bootstrap
Export the remote server state to local YAML files. The perfect starting point to bring an existing Keycloak into version control.
kaji inspect --workspace my-workspace --yeskaji validate
Safety
Checks your local YAML files for syntax errors and schema compliance before any changes reach the server.
kaji validatekaji plan
Preview
Calculates the diff between local files and the live server. Use --interactive to cherry-pick which changes to include.
kaji plan --profile prod --interactivekaji apply
Apply
Reconciles the remote state in staged order. Use --review to confirm each change individually before it's applied.
kaji apply --profile prod --reviewkaji drift
Detect
A focused shortcut for plan --changes-only. Instantly surface any configuration drift in your production Keycloak.
kaji drift --profile prodkaji cli
Interactive
An interactive TUI menu to scaffold resources, rotate keys, or perform quick operations without writing YAML by hand.
kaji clikaji detects sensitive fields on inspect and replaces them with safe placeholders. Resolve them at runtime from your environment or HashiCorp Vault.
kaji inspect to export your live Keycloak${KEYCLOAK_…} placeholders and collected in .secrets.secrets to .gitignore. Commit only the YAML resource files.${vault:…} syntax for centralized secret management.kaji apply; secrets are resolved at runtime, never written to disk.Bring your Keycloak configuration under version control today.