contract-first-idp / platform-components

GitOps manifest for the platform
0 stars 14 forks source link

Keycloak installation race condition #27

Open davgordo opened 2 months ago

davgordo commented 2 months ago

Sometimes, when installing the platform, the Keycloak certificate has not been issued yet before the Keycloak instance starts, but Keycloak starts anyway and does not present a valid certificate.

The problem is that when a certificate secret name is configured in the Keycloak CR, like this: https://github.com/contract-first-idp/platform-components/blob/main/charts/keycloak/templates/keycloak.yaml#L13 The Keycloak instance does not wait for that secret to exist. Depending on how fast cert-manager issues the certificate, Keycloak may start up without the secret data.

For now, the resolution is to simply delete the Keycloak pod and allow it to be replaced. Long term, it would be nice to prevent this condition somehow.