Keycloak links federated identities to its own user accounts, users can do this manually from the account management UI or it can automatically link them by email when a user signs in with a new IdP.
No configuration beyond setting up the federated provider required.
We used the ansible module at work but we had to fork it internally and extend it heavily. I would suggest you try https://github.com/mrparkers/terraform-provider-keycloak instead, because terraform cleans up after itself (it deletes resources that you deleted from code, rather than leaving them behind) and terraform is also much faster, because it auto-parallelizes according to the dependency graph. The terraform provider also seems much better maintained than the ansible module.
> do you believe it will still be possible to extend Keycloak using the deployment-scanner?
Even if it wouldn't bundling your keycloak-with-amenities is a 10-minutes job (1. make a pom.xml with keycloak dependency and your stuff 2. mvn package 4. there is no step 3)
When using a K8s cluster with the helm chart [1], it's actually the stateful set that takes care to the update.
When the first replica restart, Keycloak makes the updates to the database itself. Sometimes rolling back to a previous version can break. They do not hold the reverse of the database version [2].
I believe the reason behind the STS (StatefulSet) is so the cache have the time to spread among the replicas as it get upgraded.
Can you provide more detail on how you've done this?