It works pretty well but there is an error in the case that you

1) provision keycloak
2) provision shared instance
3) deprovision original keycloak
4) deprovision shared instance

I think we can be more graceful about this. We can do all namespace specific clean up and then if it is a shared instance handle the error when the keycloak is not present, as long as the error that comes back is clear enough. WDYT