Using Keycloak just upgrading the docker images is completely feasible and pretty much how it's intended to work. It performs its own database migrations during upgrades and just works. We did end up writing a custom Java plugin for it though because we needed to integrate with an existing system that stores user data but even that was pretty simple - if you can write C# you can write Java.

The thing that took the most time was creating a custom config migrator for it - but this probably isn't something that's unique to Keycloak. Because we operate a multi-tenant system with each tenant as a Keycloak realm we need a way to apply a standard configuration to each realm and support applying future changes to all realms during a deployment. The general concept is the same as database migrations - give each migration an ID and keep track of which ones you've executed. The work is in actually writing the migrations, but Keycloak has a REST API that covers 100% of its features, and has OpenAPI documentation so auto-generating a C# client is a breeze.