Gottox · Feb 9, 2026 · Feb 9, 2026 · Feb 9, 2026 · Feb 9, 2026 · Feb 9, 2026
diff --git a/.Mk.yaml b/.Mk.yaml
@@ -1,3 +1,4 @@
+build_system: cargo
 env:
   RUST_LOG: rustcloak_operator=debug,reqwest=trace,warn
   #RUST_LOG: debug

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -3,13 +3,13 @@ resolver = "2"
 members = ["rustcloak-operator", "rustcloak-crd", "utils"]
 
 [workspace.package]
-version = "0.3.2"
+version = "0.4.0"
 authors = [
   "Enno Boland <mail@eboland.de>",
 ]
 repository = "https://github.com/DenktMit-eG/rustcloak-operator"
 readme = "README.md"
-license = "AGPL-3.0"
+license = "BSD-2-Clause"
 edition = "2024"
 
 [workspace.dependencies]

diff --git a/charts/rustcloak-operator/Chart.yaml b/charts/rustcloak-operator/Chart.yaml
@@ -9,5 +9,5 @@ maintainers:
   - name: Enno Boland
     email: mail@eboland.de
     url: https://github.com/Gottox
-version: 0.3.2
-appVersion: "v0.3.2"
+version: 0.4.0
+appVersion: "v0.4.0"
diff --git a/charts/rustcloak-operator/README.md b/charts/rustcloak-operator/README.md
@@ -1,6 +1,6 @@
 # rustcloak-operator
 
-![Version: 0.3.2](https://img.shields.io/badge/Version-0.3.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.3.2](https://img.shields.io/badge/AppVersion-v0.3.2-informational?style=flat-square)
+![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.4.0](https://img.shields.io/badge/AppVersion-v0.4.0-informational?style=flat-square)
 
 The helm-chart for the rustcloak-operator
 

diff --git a/charts/rustcloak-operator/crds/clusterkeycloakinstances.rustcloak.k8s.eboland.de.yaml b/charts/rustcloak-operator/crds/clusterkeycloakinstances.rustcloak.k8s.eboland.de.yaml
@@ -57,6 +57,10 @@ spec:
                   create:
                     nullable: true
                     type: boolean
+                  namespace:
+                    description: The namespace where the secret is located. Will only be used for ClusterKeycloakInstance.
+                    nullable: true
+                    type: string
                   passwordKey:
                     nullable: true
                     type: string

diff --git a/charts/rustcloak-operator/crds/keycloakinstances.rustcloak.k8s.eboland.de.yaml b/charts/rustcloak-operator/crds/keycloakinstances.rustcloak.k8s.eboland.de.yaml
@@ -57,6 +57,10 @@ spec:
                   create:
                     nullable: true
                     type: boolean
+                  namespace:
+                    description: The namespace where the secret is located. Will only be used for ClusterKeycloakInstance.
+                    nullable: true
+                    type: string
                   passwordKey:
                     nullable: true
                     type: string

diff --git a/docs/book.toml b/docs/book.toml
@@ -1,7 +1,6 @@
 [book]
 authors = ["Enno Boland"]
 language = "en"
-multilingual = false
 src = "src"
 title = "Rustcloak Operator"
 

diff --git a/docs/src/crds/clusterkeycloakinstance.md b/docs/src/crds/clusterkeycloakinstance.md
@@ -13,6 +13,7 @@ This resource makes a Keycloak instance known to the operator
 |[spec.client.secret](#specclientsecret)|string||
 |[spec.credentials](#speccredentials)|object|✅|
 |[spec.credentials.create](#speccredentialscreate)|boolean||
+|[spec.credentials.namespace](#speccredentialsnamespace)|string||
 |[spec.credentials.passwordKey](#speccredentialspasswordkey)|string||
 |[spec.credentials.secretName](#speccredentialssecretname)|string|✅|
 |[spec.credentials.usernameKey](#speccredentialsusernamekey)|string||
@@ -101,6 +102,7 @@ Type: object
 |Property|Type|Required|
 |:-------|:---|:------:|
 |[create](#speccredentialscreate)|boolean||
+|[namespace](#speccredentialsnamespace)|string||
 |[passwordKey](#speccredentialspasswordkey)|string||
 |[secretName](#speccredentialssecretname)|string|✅|
 |[usernameKey](#speccredentialsusernamekey)|string||
@@ -117,6 +119,14 @@ Type: boolean
 
 ---
 
+### spec.credentials.namespace
+
+Type: string
+
+The namespace where the secret is located. Will only be used for ClusterKeycloakInstance.
+
+---
+
 ### spec.credentials.passwordKey
 
 Type: string

diff --git a/docs/src/crds/keycloakinstance.md b/docs/src/crds/keycloakinstance.md
@@ -13,6 +13,7 @@ This resource makes a Keycloak instance known to the operator
 |[spec.client.secret](#specclientsecret)|string||
 |[spec.credentials](#speccredentials)|object|✅|
 |[spec.credentials.create](#speccredentialscreate)|boolean||
+|[spec.credentials.namespace](#speccredentialsnamespace)|string||
 |[spec.credentials.passwordKey](#speccredentialspasswordkey)|string||
 |[spec.credentials.secretName](#speccredentialssecretname)|string|✅|
 |[spec.credentials.usernameKey](#speccredentialsusernamekey)|string||
@@ -101,6 +102,7 @@ Type: object
 |Property|Type|Required|
 |:-------|:---|:------:|
 |[create](#speccredentialscreate)|boolean||
+|[namespace](#speccredentialsnamespace)|string||
 |[passwordKey](#speccredentialspasswordkey)|string||
 |[secretName](#speccredentialssecretname)|string|✅|
 |[usernameKey](#speccredentialsusernamekey)|string||
@@ -117,6 +119,14 @@ Type: boolean
 
 ---
 
+### spec.credentials.namespace
+
+Type: string
+
+The namespace where the secret is located. Will only be used for ClusterKeycloakInstance.
+
+---
+
 ### spec.credentials.passwordKey
 
 Type: string

diff --git a/rustcloak-crd/src/crd/instance.rs b/rustcloak-crd/src/crd/instance.rs
@@ -15,6 +15,8 @@ use serde::{Deserialize, Serialize};
 pub struct KeycloakInstanceCredentialReference {
     pub create: Option<bool>,
     pub secret_name: String,
+    /// The namespace where the secret is located. Will only be used for ClusterKeycloakInstance.
+    pub namespace: Option<String>,
     pub username_key: Option<String>,
     pub password_key: Option<String>,
 }

diff --git a/rustcloak-operator/src/bin/rustcloak.rs b/rustcloak-operator/src/bin/rustcloak.rs
@@ -26,7 +26,8 @@ use rustcloak_operator::{
 fn init_logger() {
     use structured_logger::{Builder, async_json::new_writer};
 
-    Builder::with_level("info")
+    let level = structured_logger::get_env_level();
+    Builder::with_level(level.as_str())
         .with_target_writer("*", new_writer(tokio::io::stdout()))
         .init();
 }

diff --git a/rustcloak-operator/src/controller/instance_controller.rs b/rustcloak-operator/src/controller/instance_controller.rs
@@ -16,6 +16,7 @@ use kube::{
     core::object::HasStatus,
     runtime::{Controller, controller::Action, watcher},
 };
+use log::debug;
 use randstr::randstr;
 use rustcloak_crd::{
     KeycloakApiStatus,
@@ -78,14 +79,22 @@ impl<R> InstanceController<R>
 where
     R: Instance,
 {
+    fn secret_namespace(resource: &R) -> Option<String> {
+        let spec = resource.inner_spec();
+        if let Some(ns) = resource.namespace() {
+            Some(ns)
+        } else {
+            spec.credentials.namespace.clone()
+        }
+    }
     async fn create_secret(
         &self,
         client: &kube::Client,
         resource: Arc<R>,
     ) -> Result<()> {
         let spec = resource.inner_spec();
         let secret_name = &spec.credentials.secret_name;
-        let ns = resource.namespace();
+        let ns = Self::secret_namespace(&resource);
         let secret_api = ApiExt::<Secret>::api(client.clone(), &ns);
         let [username_key, password_key] = spec.credentials.secret_key_names();
 
@@ -109,7 +118,6 @@ where
             data: Some(data),
             metadata: ObjectMeta {
                 name: Some(secret_name.to_string()),
-                namespace: ns,
                 owner_references: Some(vec![owner_ref]),
                 ..Default::default()
             },
@@ -173,6 +181,7 @@ where
         resource: Arc<Self::Resource>,
     ) -> Result<bool> {
         let spec = resource.inner_spec();
+        debug!("Scheduling refresh for resource {}", resource.name_any());
         match self
             .manager
             .schedule_refresh(&resource, client.clone())

diff --git a/rustcloak-operator/src/controller/legacy/instance.rs b/rustcloak-operator/src/controller/legacy/instance.rs
@@ -84,6 +84,7 @@ impl LifecycleController for LegacyInstanceController {
                     secret_name: format!("credential-{}", &name),
                     username_key: Some("ADMIN_USERNAME".to_string()),
                     password_key: Some("ADMIN_PASSWORD".to_string()),
+                    namespace: None,
                 },
                 token: None,
                 client: None,

diff --git a/rustcloak-operator/src/util/k8s_keycloak.rs b/rustcloak-operator/src/util/k8s_keycloak.rs
@@ -16,7 +16,10 @@ use kube::{
     runtime::reflector::ObjectRef,
 };
 use log::{debug, warn};
-use rustcloak_crd::{instance::KeycloakInstance, traits::SecretKeyNames};
+use rustcloak_crd::{
+    instance::KeycloakInstance,
+    traits::SecretKeyNames,
+};
 use std::{
     borrow::Cow,
     collections::{BTreeMap, HashMap},
@@ -32,6 +35,18 @@ use tokio::{
 
 use super::SecretUtils;
 
+fn secret_namespace<R>(resource: &R) -> Option<String>
+where
+    R: Instance,
+{
+    let spec = resource.inner_spec();
+    if let Some(ns) = resource.namespace() {
+        Some(ns)
+    } else {
+        spec.credentials.namespace.clone()
+    }
+}
+
 fn token_into_secret<R: Instance>(
     oauth2_token: &OAuth2Token,
     instance: &R,
@@ -45,7 +60,6 @@ fn token_into_secret<R: Instance>(
         .map(|x| ByteString(x.to_rfc3339().into_bytes()));
     let name = spec.token_secret_name(&name);
     let [token_key, expires_key] = spec.token.secret_key_names();
-    let ns = instance.namespace();
     let owner_ref = instance.owner_ref(&()).unwrap();
     let mut data: BTreeMap<String, ByteString> =
         [(token_key.to_string(), token)].into();
@@ -55,7 +69,6 @@ fn token_into_secret<R: Instance>(
     Ok(Secret {
         metadata: ObjectMeta {
             name: Some(name),
-            namespace: ns,
             owner_references: Some(vec![owner_ref]),
             ..Default::default()
         },
@@ -115,7 +128,7 @@ impl<'a> K8sKeycloakBuilder<'a> {
 
     pub async fn with_credentials(self) -> Result<ApiClient> {
         let spec = &self.instance.spec;
-        let ns = self.instance.namespace();
+        let ns = secret_namespace(&self.instance);
         let kind = &self.kind;
         let secret_api = ApiExt::<Secret>::api(self.client.clone(), &ns);
         let credential_secret_name = spec.credential_secret_name().to_string();
@@ -141,7 +154,7 @@ impl<'a> K8sKeycloakBuilder<'a> {
     pub async fn with_token(self) -> Result<ApiClient> {
         let spec = &self.instance.spec;
         let name = self.instance.name_unchecked();
-        let ns = self.instance.namespace();
+        let ns = secret_namespace(&self.instance);
         let kind = &self.kind;
         let secret_api = ApiExt::<Secret>::api(self.client.clone(), &ns);
         let token_secret_name = spec.token_secret_name(&name).to_string();
@@ -186,7 +199,7 @@ impl<R: Instance> K8sKeycloakRefreshJob<R> {
     }
 
     pub async fn update_token_secret(&self, token: &OAuth2Token) -> Result<()> {
-        let ns = self.instance.namespace();
+        let ns = secret_namespace(self.instance.deref());
         let api = ApiExt::<Secret>::api(self.client.clone(), &ns);
         let token_secret = token_into_secret(token, self.instance.deref())?;
         api.patch(