diff --git a/k8s/infra/auth/keycloak/config/client-cloudflare.yaml b/k8s/infra/auth/keycloak/config/client-cloudflare.yaml
new file mode 100644
index 0000000..b023275
--- /dev/null
+++ b/k8s/infra/auth/keycloak/config/client-cloudflare.yaml
@@ -0,0 +1,20 @@
+apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
+kind: Client
+metadata:
+  name: cloudflare
+spec:
+  deletionPolicy: Delete
+  forProvider:
+    name: Cloudflare
+    accessType: CONFIDENTIAL
+    clientId: cloudflare
+    realmIdRef:
+      name: homelab
+    clientSecretSecretRef:
+      name: cloudflare-oidc-credentials
+      namespace: keycloak
+      key: secret
+    standardFlowEnabled: true
+    baseUrl: "https://stonegarden.cloudflareaccess.com"
+    validRedirectUris:
+      - "https://stonegarden.cloudflareaccess.com/cdn-cgi/access/callback"
diff --git a/k8s/infra/auth/keycloak/config/cloudflare-oidc-credentials.yaml b/k8s/infra/auth/keycloak/config/cloudflare-oidc-credentials.yaml
new file mode 100644
index 0000000..b039d9a
--- /dev/null
+++ b/k8s/infra/auth/keycloak/config/cloudflare-oidc-credentials.yaml
@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-oidc-credentials
+  namespace: keycloak
+spec:
+  encryptedData:
+    key: AgB1jFD1jq7ri58egGkilGnaULqMvx3V6nsOoJNrn10OshfyouMHKVaC+6LywQATe88/5AIW37PMwh1XfLFjXH4EFoqA/93S44gxHtLoJ08Im59MnGJStn3gr9ClxNmukOUVE25vUkcKqDvlUa7UqHwoeppr/QN2byuwXB/cRhoZnG/KJuI5358SBjl1QseXqm5R5Gk7g36pXUhlDnsVicN7uYwxOE0BlYHtdlihWyecBWOIxKkLXIeSALmKcxDpE5v08wmN1MARSV58YfZiTEFWFWmpnPvxWZS3fHhHpppZjD6uRrKnXQlNH1KjN5Ccs29LB/tBVD9qt4fvvISKzWCXRkb2BCgAZo2MyhScemIq3MkTG7lMD2hEW9TAviOqZKmLg1OILKTKG5bq84ygB5vsseVNtj+jfUCyzaHyCH2bANfTDZA0HyhQl1WFhpXOX8k3kBhhCKOnpYa2XYDEHMtnVXgqsIf1lMOrG9+PADjrVTLu0Zh+gxpRNvs8aIfrrLxOzoMi6jOzuj2NoydRNLkfn8cAGsoO4MQREZdytCLbU+dXcXSr+ZKJOpStR8fwmNZzoK92sU7ya+a3NceYjrIOwpG2EyWrdUDNmX5RcUPBnaenmPfFgm3ry6EivrILRG5VV8kn8uyOXHL3qNmzHe24Y8mm92UCPWAFSxYqhru/EXMGEMriHepJlaahdTLLI/uEcSwNRvleWFoS
+    secret: AgCLgiXGxb1QP79KDOJanMq/wt+yTU4kDfEqc1D0zwJZCJD0kSzplKiUPuWjazRfa8abkh02Hv9HnpxblF2GE9jSq/bLCdszp2QhJFoWJlCpyBikTnwZWeXJVPu7ho40R6MuRsQC4hf1uysQgrnQItY730npI1dfxl7VLbkZX0QNPagHTUT01LsQ9u1i1mmfh0S0SLIQw8BAiQfZR8FSDkEuxjmIWVvtgs1Ok3sC6IbSocVnzQ6DlCntkJVef2W6/S9F+GqOrEgNdIWZI/rPClFUPXdhWd+JsuEGiw51xgF6PApcxo2QTOQngXAITnsYR1pYWR/VaQ9wcx6jUYzkknzlU1sVZgcU9TxKofIXNPAP5uabPD3NX6ZmmXEpNa8DwO2h0LnXOOHEKmNhb+zAT5o8T4Bf9GmsGCP19+xc2+ebTV/bIvV9PDwEJjyBZ9sSXirXcfu04ToyKdLsDW28QTwHRD48fA10aWqxRbeKEFIQ9tfAWEdBZ2dhLnwhUMvyEVKiCGAi0AeLNRlZFN/IMEq+WoZu4iugSgm1GRjQnTYROdxJWBC/gL2OVMWpGFhr9We0ZeuH79OtMQrvOdfopqk7d7sCWAhiSk3iCbupnyOpkQKRSvYxD5mwD0DteFc1gABBdSdK03qcG+d4MsiC98F9OFZguaOtEHlIFHa4wSIOWdGPAQK4GhuVTkHm9oAp4PXQSKwqFOi4PLoL37A8gGSWAr/Z3aYuRrcwDi8U+42HHz8rEmpc8y8c
+  template:
+    metadata:
+      name: cloudflare-oidc-credentials
+      namespace: keycloak
+    type: Opaque
diff --git a/k8s/infra/auth/keycloak/config/kustomization.yaml b/k8s/infra/auth/keycloak/config/kustomization.yaml
new file mode 100644
index 0000000..2111df3
--- /dev/null
+++ b/k8s/infra/auth/keycloak/config/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - realms.yaml
+  - users.yaml
+  - client-cloudflare.yaml
+  - cloudflare-oidc-credentials.yaml
diff --git a/k8s/infra/auth/keycloak/config/realms.yaml b/k8s/infra/auth/keycloak/config/realms.yaml
new file mode 100644
index 0000000..750f455
--- /dev/null
+++ b/k8s/infra/auth/keycloak/config/realms.yaml
@@ -0,0 +1,7 @@
+apiVersion: realm.keycloak.crossplane.io/v1alpha1
+kind: Realm
+metadata:
+  name: homelab
+spec:
+  forProvider:
+    realm: homelab
diff --git a/k8s/infra/auth/keycloak/config/users.yaml b/k8s/infra/auth/keycloak/config/users.yaml
new file mode 100644
index 0000000..93d1723
--- /dev/null
+++ b/k8s/infra/auth/keycloak/config/users.yaml
@@ -0,0 +1,13 @@
+apiVersion: user.keycloak.crossplane.io/v1alpha1
+kind: User
+metadata:
+  name: veh
+spec:
+  forProvider:
+    enabled: true
+    email: vegard@stonegarden.dev
+    firstName: Vegard
+    lastName: Hagen
+    username: veh
+    realmIdRef:
+      name: homelab
\ No newline at end of file
diff --git a/k8s/infra/auth/keycloak/kustomization.yaml b/k8s/infra/auth/keycloak/kustomization.yaml
index 2dd2592..402db19 100644
--- a/k8s/infra/auth/keycloak/kustomization.yaml
+++ b/k8s/infra/auth/keycloak/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - secret-keycloak-admin.yaml
   - secret-keycloak-db-credentials.yaml
   - http-route.yaml
+  - config
 
 helmCharts:
   - name: keycloak
diff --git a/k8s/infra/controllers/crossplane/providers/keycloak/keycloak-credentials.yaml b/k8s/infra/controllers/crossplane/providers/keycloak/keycloak-credentials.yaml
index 98b7c28..3be9aa8 100644
--- a/k8s/infra/controllers/crossplane/providers/keycloak/keycloak-credentials.yaml
+++ b/k8s/infra/controllers/crossplane/providers/keycloak/keycloak-credentials.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: crossplane
 spec:
   encryptedData:
-    credentials: AgC1UwnOntsUCENt8DDyhkJ4mAYNbprWN1ebddr/A9CpLoZGhAArw3GqehUKmknAIog4nCzMb3VeJKmR3RC3OXoOjKmCWeiifrBrXArvtbApPkK3juSwNiJJ0KCDp23e/bXujYuvWIY83CadY01HTIfKcT9pLB/LFRwFHmcoDhdw7Yc1QPgx11gxtBPJyYe6MDRDlLso45rzfuO9HxWao/bh44OK5IND3W2zcIrDBYaPChN77fEiJN0XjZL4u6fnJwH72D1eHiNycAzanxKLQNaEl/Y/2fjQPkvEqpG08IkKtANFBGyC72bNnRwIxX3tIBV6dXnVoWYV5MEn5qhPPiEuqPVjlTYCfaQK5ZZAc6dKTpdGzA+s9MYbjLbdFtUa0VbYvdVKfrxjiJYWk/8kgktcR/hdo/mntGoKwdDTNHycXJduPKtzx02yj1hAXQ/1kyWhuX5YsEZ0xdzE2aO1TvxJ7wIeQ7ozHq2h6W0F0N9w/lpLfWn654321Ca3KxWN3HGqqzIM3yAsMfX0RsmafepNEDyGPHlCkpNHvouBm3QFBNXiMprJeqcwDuM0SnrrHQdTNGBpmN0V9TxQO06tgva31aA/2vkFJJ+tq90J6yBMNRSsiySJD7MvQ6yt0s5O8es765fxszG+tR5sJTHgbWrMPlVdLIz5JR+LS+L+g7ek6AlqpU7WgMuylb+XAvDfJQH3rjtyNArKR+qaAxpIcSMZUlAUHvhdnn/nmudDg+3UBZQmfkriVrA+tCeeH84reHOPFO5aJBM/+if/qgibGHCXqf/JS/vJZX168XZcDBVkhd9ue7iH0j7on0lji8ch0HTqP6FQgZ9Mm2zZVL035jtZWN77UCwD0Pn2q4C+dq6mgh79KQABMuPwI5GiOeattecFY9SRAD+n4cqNnbAtVECP
+    credentials: AgC01M3DaKy//JFVDlXhXfN24aL8vMlwtvSqBK61MIiDEqzEfWmjQq1h2dUF4+dmY5nel6165m8AEUWPhsslyUA8BMkD2XyP9rEJlsLdfcpFDUwHe0fSJDXlSho7MEllK08VVVwjk2rZnOil9LBTOGT7FFuXCuaiR5CWKjby/SLHoxynlCQqEHYMTQtT5iwwjkbrBa3LPh+VM8z2VrQzF5yx8fmundnNVxcMhV6V9fKiWj+8+gZsZtifNEcSp2MpVUQyTo1q5YExz1hGyA2LAWBqzhyoGJ+L4iqn+H2C7ZvPX+j040ZMo+d0LmiQwbrscAb/HJXv1zZFOlC0+HQecn8aLOPga+ITsAXdnNOXQ/3CjuyngwJXi6xn8aThpCNF12ut0OxvGtrPYSTs1F909c1jsHbFcpMlncxK28OMYfcO3Vhx/K+ZynCo50XhyGv52fueEvynTMv9eFQngQeX64UqXHC8P7NclbeFKswH6MMWPME9+RZLU4hHy/LuxhI5EH+9w/ucDDLpkiBTZgSfOcmGJI8h2cQERKF4Y09Br1jT/ZIYF6DSCFsmKAeFnkgBTtVsi2yr/wXeftOHUYv/WDjfPMtKQcUAdtZgZ8sdXk9wCwHcv+uTbQr6BFRX9R2oemOIiSfBXJZW79k5HAghlva2KocVCOsvydeBrWKihNf9grqO2jvEmQwjU/yb9vFXvLhdEZZkk0v3dFhE01qZOp4kqo2Z7PS5axJFGLA6NKegiWzjVlDA1E5ODBYNi9b5PHc/Jff058YU3bhQECKqm5T37+4zesfwdZ+/T/r5DU4qlS3P8hE4JAr2SORQ7ExYYCWBXUCTXOsPQobkIvvWuRrPTU3wEwgzGMuVEqn0S5Sp/fVG3M6PBIenwTvhKCOJZckpt6gwI3FyUbrr6uLvIbs=
   template:
     metadata:
       labels:
diff --git a/k8s/infra/controllers/crossplane/providers/keycloak/provider.yaml b/k8s/infra/controllers/crossplane/providers/keycloak/provider.yaml
index 84e759a..6a008a3 100644
--- a/k8s/infra/controllers/crossplane/providers/keycloak/provider.yaml
+++ b/k8s/infra/controllers/crossplane/providers/keycloak/provider.yaml
@@ -1,6 +1,6 @@
 apiVersion: pkg.crossplane.io/v1
 kind: Provider
 metadata:
-  name: keycloak
+  name: provider-keycloak
 spec:
   package: xpkg.upbound.io/crossplane-contrib/provider-keycloak:v1.0.0
diff --git a/k8s/infra/controllers/project.yaml b/k8s/infra/controllers/project.yaml
index 986434f..88083c7 100644
--- a/k8s/infra/controllers/project.yaml
+++ b/k8s/infra/controllers/project.yaml
@@ -11,6 +11,8 @@ spec:
       server: '*'
     - namespace: 'cert-manager'
       server: '*'
+    - namespace: 'crossplane'
+      server: '*'
     - namespace: 'node-feature-discovery'
       server: '*'
     - namespace: 'intel-device-plugins'
diff --git a/k8s/sets/applications.yaml b/k8s/sets/applications.yaml
index 5663d26..5a36335 100644
--- a/k8s/sets/applications.yaml
+++ b/k8s/sets/applications.yaml
@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: applications
   namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
 spec:
   project: app-of-apps
   source:
diff --git a/k8s/sets/infrastructure.yaml b/k8s/sets/infrastructure.yaml
index ad076c9..21bff92 100644
--- a/k8s/sets/infrastructure.yaml
+++ b/k8s/sets/infrastructure.yaml
@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: infrastructure
   namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
 spec:
   project: app-of-apps
   source: