diff --git a/incubator/keycloak/Chart.yaml b/incubator/keycloak/Chart.yaml
index 812a1a0b03..80f652bc6e 100644
--- a/incubator/keycloak/Chart.yaml
+++ b/incubator/keycloak/Chart.yaml
@@ -1,5 +1,5 @@
 name: keycloak
-version: 0.2.0
+version: 0.2.1
 appVersion: 3.4.0.Final
 description: Open Source Identity and Access Management For Modern Applications and Services
 keywords:
diff --git a/incubator/keycloak/README.md b/incubator/keycloak/README.md
index 6f3db5489b..ecb20a209e 100644
--- a/incubator/keycloak/README.md
+++ b/incubator/keycloak/README.md
@@ -86,6 +86,9 @@ Parameter | Description | Default
 `postgresql.postgresUser` | The PostgreSQL user (if `keycloak.persistence.deployPostgres=true`) | `keycloak`
 `postgresql.postgresPassword` | The PostgreSQL password (if `keycloak.persistence.deployPostgres=true`) | `""`
 `postgresql.postgresDatabase` | The PostgreSQL database (if `keycloak.persistence.deployPostgres=true`) | `keycloak`
+`rbac.create` | Specifies whether RBAC resources should be created | `true`
+`serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true`
+`serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""`
 `test.image.repository` | Test image repository | `unguiculus/docker-python3-phantomjs-selenium`
 `test.image.tag` | Test image tag | `v1`
 `test.image.pullPolicy` | Test image pull policy | `IfNotPresent`
diff --git a/incubator/keycloak/templates/_helpers.tpl b/incubator/keycloak/templates/_helpers.tpl
index 49169cfc29..978d80171f 100644
--- a/incubator/keycloak/templates/_helpers.tpl
+++ b/incubator/keycloak/templates/_helpers.tpl
@@ -95,3 +95,14 @@ Create environment variables for database configuration.
   value: {{ .Values.keycloak.persistence.dbName | quote }}
 {{- end }}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "keycloak.serviceAccountName" -}}
+  {{- if .Values.serviceAccount.create -}}
+      {{ default (include "keycloak.fullname" .) .Values.serviceAccount.name }}
+  {{- else -}}
+      {{ default "default" .Values.serviceAccount.name }}
+  {{- end -}}
+{{- end -}}
diff --git a/incubator/keycloak/templates/rbac.yaml b/incubator/keycloak/templates/rbac.yaml
new file mode 100644
index 0000000000..54ed13e49f
--- /dev/null
+++ b/incubator/keycloak/templates/rbac.yaml
@@ -0,0 +1,32 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "keycloak.fullname" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "keycloak.fullname" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "keycloak.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "keycloak.serviceAccountName" . }}
+{{- end -}}
diff --git a/incubator/keycloak/templates/serviceaccount.yaml b/incubator/keycloak/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..d9d5afda98
--- /dev/null
+++ b/incubator/keycloak/templates/serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "keycloak.serviceAccountName" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- end -}}
diff --git a/incubator/keycloak/templates/statefulset.yaml b/incubator/keycloak/templates/statefulset.yaml
index dc6d1f4f29..f2e8169bbb 100644
--- a/incubator/keycloak/templates/statefulset.yaml
+++ b/incubator/keycloak/templates/statefulset.yaml
@@ -21,6 +21,7 @@ spec:
         app: {{ template "keycloak.name" . }}
         release: "{{ .Release.Name }}"
     spec:
+      serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
     {{- if .Values.keycloak.persistence.deployPostgres }}
       initContainers:
         - name: wait-for-postgresql
diff --git a/incubator/keycloak/values.yaml b/incubator/keycloak/values.yaml
index 78da2caa62..d420f33468 100644
--- a/incubator/keycloak/values.yaml
+++ b/incubator/keycloak/values.yaml
@@ -183,6 +183,17 @@ postgresql:
     ##
     enabled: true
 
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a ServiceAccount should be created
+  create: true
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
 test:
   image:
     repository: unguiculus/docker-python3-phantomjs-selenium