Keycloak is fairly easy to maintain. I run a deploy in AWS/ECS, and nearly never needs to be touched... except when an upgrade is required. Every upgrade has been challenging, starting with change to Quarkus, followed by removing dependencies from the docker images.

But when it's not being upgrade, it's fantastic. Many thanks to Red Hat.