search

adorsys / keycloak-config-cli

Import YAML/JSON-formatted configuration files into Keycloak - Configuration as Code for Keycloak.
Apache License 2.0
734 stars 138 forks source link

Checking on KEYCLOAK_AVAILABILITYCHECK_TIMEOUT variable #719

Closed ic2hrmk closed 2 years ago

ic2hrmk commented 2 years ago

Current Behavior

Hello there,

I am looking for a suggestion on how to delay the Keycloak Config CLI bootstrap process during the app initialization.

Given:

We have a Keycloak Config CLI as a regular pod in our deployment (requirements from a DevOps team). The environment is being updated in a rolling-update fashion. So, new instances of Keycloak & Keycloak Config CLI are being deployed simultaneously.

A new instance of Keycloak Config CLI starts earlier than the new Keycloak server (which usually takes up to 90 seconds), checks settings against the old Keylcloak server instance, and as long as checksums are matching, the new Keycloak Config CLI gives up and stops bootstrapping process.

Old Keycloak is being shut off by the K8S and the new Keycloak server leaves configured.

Later on, I tried to enable the configuration including KEYCLOAK_AVAILABILITYCHECK=true & KEYCLOAK_AVAILABILITYCHECK_TIMEOUT=90s. I expected that Keycloak Config CLI will suspend for 90 seconds and after this delay will start its checks, but it proceeded without waiting for it.

Is it possible to somehow delay the initial Keycloak availability check on the Keycloak Config CLI?

Expected Behavior

No response

Steps To Reproduce

1. Deploy the Keycloak server (no persistence) & Keycloak Config CLI as K8S deployment(s)
2. Update this deployment with the K8S rolling update

Environment

Anything else?

No response

jkroepke commented 2 years ago

Hi @ic2hrmk ,

The env KEYCLOAK_AVAILABILITYCHECK_ENABLED is the correct and documented one.

In case, KEYCLOAK_AVAILABILITYCHECK has been worked previously, it was an unindented and unknown side effect of spring boot which my resolved upstream.

ic2hrmk commented 2 years ago

Hi @jkroepke, thank you for the prompt response! This way, can you please clarify what KEYCLOAK_AVAILABILITYCHECK_TIMEOUT modifies in the Keycloak Config CLI's behavior?

Thanks!

jkroepke commented 2 years ago

its the timeout how long keycloak-config-cli will retry the login.

ic2hrmk commented 2 years ago

Ok, got it. Thank you for the details!