I was a long time k8s skeptical, but I think it's solid now. If there's good support for keycloak for k8s with support for backups I wouldn't think twice.

Not sure the state of keycloak now, but it was a lot of work to manage keycloak configs with the IaC pipeline. That could have gotten better now, but I think having access to the data is important because migration might not be trivial if for instance a provider starts acting up.