[[_client-cr]]
=== Creating a client custom resource

You can use the Operator to create clients in {project_name} as defined by a custom resource.  You define the properties of the realm in a YAML file. 

[NOTE]
====
You can update the YAML file and changes appear in the {project_name} admin console, however changes to the admin console do not update the custom resource.
====

.Example YAML file for a Client custom resource
```yaml
apiVersion: keycloak.org/v1alpha1
kind: KeycloakClient
metadata:
  name: example-client
  labels:
ifeval::[{project_community}==true]
    app: app=example-keycloak
endif::[]  
ifeval::[{project_product}==true]
    app: sso
endif::[]  
spec:
  realmSelector:
     matchLabels:
      app: <matching labels for KeycloakRealm custom resource>
  client:
    # auto-generated if not supplied
    #id: 123
    clientId: client-secret
    secret: client-secret
    # ...
    # other properties of Keycloak Client
```

.Prerequisites

* You have a YAML file for this custom resource.

* You have cluster-admin permission or an equivalent level of permissions granted by an administrator.

.Procedure

. Use this command on the YAML file that you created: `{create_cmd} -f <client-name>.yaml`. For example:
+
[source,bash,subs=+attributes]
----
$ {create_cmd} -f initial_client.yaml
keycloak.keycloak.org/example-client created
----

. Log into the {project_name} admin console for the related instance of {project_name}.

. Click Clients.
+
The new client appears in the list of clients.
+
image:images/clients.png[]

.Results
After a client is created, the Operator creates a Secret containing the `Client ID` and the client's secret using the following naming pattern: `keycloak-client-secret-<custom resource name>`. For example:

.Client's Secret
```yaml
apiVersion: v1
data:
  CLIENT_ID: <base64 encoded Client ID>
  CLIENT_SECRET: <base64 encoded Client Secret>
kind: Secret
```

After the Operator processes the custom resource, view the status with this command:

[source,bash,subs=+attributes]
----
$ {create_cmd_brief} describe keycloak <CR-name>
----

.Client custom resource Status
```yaml
Name:         client-secret
Namespace:    keycloak
ifeval::[{project_community}==true]
Labels:       app=example-keycloak
endif::[]  
ifeval::[{project_product}==true]
Labels:       app=sso
endif::[]  
API Version:  keycloak.org/v1alpha1
Kind:         KeycloakClient
Spec:
  Client:
    Client Authenticator Type:     client-secret
    Client Id:                     client-secret
    Id:                            keycloak-client-secret
  Realm Selector:
    Match Labels:
ifeval::[{project_community}==true]
      App:  keycloak
endif::[]  
ifeval::[{project_product}==true]
      App:  sso
endif::[]  
Status:
  Message:
  Phase:    reconciling
  Ready:    true
  Secondary Resources:
    Secret:
      keycloak-client-secret-client-secret
Events:  <none>
```

.Additional resources

* When the client creation completes, you are ready to xref:_user-cr[create a user custom resource].