Issues running Keycloak on Digital Ocean Kubernetes cluster

[sewah2012]

Hi @ThomasVitale ,

Please I am having some difficuties running Keycloak on the production cluster on digital. Each time i run the deploy script it hangs for a while and timeout. So I decided to check the logs of the container on DO. and I got this:

keycloak 14:55:49.97 keycloak 14:55:49.97 Welcome to the Bitnami keycloak container keycloak 14:55:49.97 Subscribe to project updates by watching https://github.com/bitnami/containers keycloak 14:55:49.98 Submit issues and feature requests at https://github.com/bitnami/containers/issues keycloak 14:55:49.98 keycloak 14:55:49.98 INFO ==> Starting keycloak setup keycloak 14:55:50.00 INFO ==> Validating settings in KEYCLOAK_* env vars... keycloak 14:55:50.02 INFO ==> Trying to connect to PostgreSQL server polar-keycloak-postgresql... keycloak 14:55:50.04 INFO ==> Found PostgreSQL server listening at polar-keycloak-postgresql:5432 keycloak 14:55:50.05 INFO ==> Configuring database settings keycloak 14:55:50.09 INFO ==> Enabling statistics keycloak 14:55:50.11 INFO ==> Configuring http settings keycloak 14:55:50.14 INFO ==> Configuring hostname settings keycloak 14:55:50.15 INFO ==> Configuring cache count keycloak 14:55:50.17 INFO ==> Configuring log level keycloak 14:55:50.18 INFO ==> Configuring proxy keycloak 14:55:50.20 INFO ==> keycloak setup finished! keycloak 14:55:50.22 INFO ==> Starting keycloak Appending additional Java properties to JAVA_OPTS: -Dkeycloak.import=/opt/keycloak/data/import/realm-config.json Updating the configuration and installing your custom providers, if any. Please wait. 2023-04-06 14:55:57,939 WARN [org.keycloak.services] (build-56) KC-SERVICES0047: metrics (org.jboss.aerogear.keycloak.metrics.MetricsEndpointFactory) is implementing the internal SPI realm-restapi-extension. This SPI is internal and may change without notice 2023-04-06 14:55:59,073 WARN [org.keycloak.services] (build-56) KC-SERVICES0047: metrics-listener (org.jboss.aerogear.keycloak.metrics.MetricsEventListenerFactory) is implementing the internal SPI eventsListener. This SPI is internal and may change without notice 2023-04-06 14:56:09,249 INFO [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 15419ms 2023-04-06 14:56:11,997 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: , Hostname: , Strict HTTPS: false, Path: , Strict BackChannel: false, Admin URL: , Admin: , Port: -1, Proxied: true 2023-04-06 14:56:14,020 INFO [org.keycloak.common.crypto.CryptoIntegration] (main) Detected crypto provider: org.keycloak.crypto.def.DefaultCryptoProvider 2023-04-06 14:56:16,904 WARN [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled 2023-04-06 14:56:16,921 WARN [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal 2023-04-06 14:56:17,023 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller' 2023-04-06 14:56:17,746 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000128: Infinispan version: Infinispan 'Triskaidekaphobia' 13.0.9.Final 2023-04-06 14:56:18,015 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel ISPN 2023-04-06 14:56:20,079 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (development) mode 2023-04-06 14:56:20,081 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start caches 2023-04-06 14:56:20,082 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: org.infinispan.manager.EmbeddedCacheManagerStartupException: org.infinispan.commons.CacheConfigurationException: ISPN000085: Error while trying to create a channel using the specified configuration file: default-configs/default-jgroups-kubernetes.xml 2023-04-06 14:56:20,083 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: org.infinispan.commons.CacheConfigurationException: ISPN000085: Error while trying to create a channel using the specified configuration file: default-configs/default-jgroups-kubernetes.xml 2023-04-06 14:56:20,083 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: ISPN000085: Error while trying to create a channel using the specified configuration file: default-configs/default-jgroups-kubernetes.xml 2023-04-06 14:56:20,084 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: dns_query can not be null or empty 2023-04-06 14:56:20,085 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

It seems that Keycloak is not starting. would appreciate any assistance.

Regards.

[jempitman]

I have also been having the same issue with the keycloak deploy.sh script, and have thus far not managed to find a solution:

keycloak % ./deploy.sh

🗝️ Keycloak deployment started.

📦 Installing Keycloak... namespace/keycloak-system created configmap/keycloak-config created

📦 Configuring Helm chart... "bitnami" already exists with the same configuration, skipping Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "bitnami" chart repository Update Complete. ⎈Happy Helming!⎈ Release "polar-keycloak" does not exist. Installing it now. NAME: polar-keycloak LAST DEPLOYED: Tue Apr 25 12:47:22 2023 NAMESPACE: keycloak-system STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: CHART NAME: keycloak CHART VERSION: 14.2.0 APP VERSION: 21.0.2

Please be patient while the chart is being deployed

Keycloak can be accessed through the following DNS name from within your cluster:

polar-keycloak.keycloak-system.svc.cluster.local (port 80)

To access Keycloak from outside the cluster execute the following commands:

1. Get the Keycloak URL by running these commands:

   NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch its status by running 'kubectl get --namespace keycloak-system svc -w polar-keycloak'

   export HTTP_SERVICE_PORT=$(kubectl get --namespace keycloak-system -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services polar-keycloak) export SERVICE_IP=$(kubectl get svc --namespace keycloak-system polar-keycloak -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

   echo "http://${SERVICE_IP}:${HTTP_SERVICE_PORT}/"

2. Access Keycloak using the obtained URL.

⌛ Waiting for Keycloak to be deployed...

⌛ Waiting for Keycloak to be ready... error: timed out waiting for the condition on pods/polar-keycloak-0

As seen above, the script throws a timeout error whilst waiting for the polar-keycloak-0 pod to be ready and falls into a CrashLoopBackOff state.

The issue seems to be that the server within the polar-keycloak-0 pod does not start: is this a property defined in the keycloak-config.yml file or is it managed by Bitnami? Should the issue be raised within the Bitnami/keycloak repo?

Is there an alternative way to deploy a keycloak authentication service on Digital Ocean?

[sewah2012]

i hope @ThomasVitale can come to the rescue at his most available time

[ThomasVitale]

@sewah2012 @jempitman thank you both very much for reporting this issue. I should have blocked the Helm chart version in the scripts. The problem is that newer Chart versions from Bitnami don't work with Keycloak 19, which is the version used in the book. I have updated the scripts now and they should work correctly on DigitalOcean. It would be great if you could verify they work for you as well, thank you so much! You can find the necessary change in https://github.com/ThomasVitale/cloud-native-spring-in-action/commit/de5401d48ad08b3e56b187c80c25dd6614aa2cad

[jempitman]

Hi @ThomasVitale, thank you for updating the script, it is now correctly for me.

[ThomasVitale]

@jempitman thanks for confirming it works, I'll close the issue now. Feel free to register new issues should you encounter further problems with the scripts, thank you!