After discussing this with Stian we decided on the following:
we will support configuring the browser redirection flow via the Realm CR
but make it obvious that it is not part of the realm specification. Instead
we will add an extra property to the CR which allows a number of overrides:
spec:
...
realmOverrides:
- redirectorIdentityProvider: 'openshift-v4'
forFlow: 'browser'
No other overrides will be supported and as soon as the Keycloak API
supports updates to flows, the overrides will be deprecated.