There is a potential security issue with the KeycloakRealmImport custom resource. Placeholders within the realm document, which may reference environment variables, will be replaced as part of the import process. That provides a way to inject into the realm sensitive environment variables, such as the database password. See https://github.com/keycloak/keycloak/blob/75afda410495a9576e00edc3277ab42ca155f806/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L35