keycloakbitnamidev-to-production

Keycloak using bitnami with production config


I've been trying to get a HA production ready Keycloak up and running for a week now and I'm starting to become quite annoyed..

Yesterday I decided to go with helm & bitnami (cause it's supposed to be simpler), but I'm running into issue after issue... Could someone please help me?

Here's my bitnami values.yaml file:

auth:
  adminUser: admin
  adminPassword: admin
  managementUser: manager
  managementPassword: manager

extraEnvVars:
  - name: KEYCLOAK_PRODUCTION
    value: "true"
  - name: KEYCLOAK_EXTRA_ARGS
    value: "--auto-build"

proxy: edge
replicaCount: 2
resources:
  requests:
    memory: "512Mi"
    cpu: "500m"
  limits:
    memory: "1024Mi"
    cpu: "1000m"

postgresql:
  enabled: false

externalDatabase:
  database: keycloak
  host: {host}
  user: {user}
  password: {password}

cache:
  enabled: true

ingress:
  enabled: true
  hostname: {hostname}
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: {certArn}
    alb.ingress.kubernetes.io/ssl-redirect: '443'

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 5

Apparently I'm not supposed to use --auto-build, but if I'm not using it, Keycloak doesn't find the postgres driver. I'm pretty sure that's because the ENV variable KC_DB=postgres need to be added to Keycloak during build step, but I can't really change that behaviour since it's not my image?

Either way, using --auto-build fixes the issue, but when I go to my Keycloak domain, it looks like all of the css e.t.c. can't load..bitnami/keycloak welcome page issue

If I disregard all of that and click on Administration Console, I get a 404..

Also, during startup I get a warning regarding the cache:

2022-10-05 10:35:22,624 WARN  [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
2022-10-05 10:35:22,912 WARN  [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled

I've tried multiple different Keycloak versions from 18.0.0 to 19.0.2.

Should it really be this hard to get Keycloak up and running?
Any help is greatly appreciated, I'm starting to lose my sanity here...


Solution

  • So I finally got it working, here's my final values.yaml file if anyone is stuck with getting Keycloak running in production mode:

    auth:
      adminUser: admin
      adminPassword: admin
    
    extraEnvVars:
      - name: KEYCLOAK_PRODUCTION
        value: "true"
      - name: KEYCLOAK_EXTRA_ARGS
        value: "--auto-build"
      - name: KC_CACHE_STACK
        value: kubernetes
    
    proxy: edge
    cache:
      enabled: true
    
    replicaCount: 2
    resources:
      requests:
        memory: "512Mi"
        cpu: "500m"
      limits:
        memory: "1024Mi"
        cpu: "1000m"
    
    postgresql:
      enabled: false
    
    externalDatabase:
      database: keycloak
      host: {aws-rds-instance}.{aws-region}.rds.amazonaws.com
      user: {user}
      password: {password}
    
    ingress:
      enabled: true
      hostname: {domain}
      path: /*
      annotations:
        kubernetes.io/ingress.class: alb
        alb.ingress.kubernetes.io/scheme: internet-facing
        alb.ingress.kubernetes.io/target-type: ip
        alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
        alb.ingress.kubernetes.io/certificate-arn: {certArn}
        alb.ingress.kubernetes.io/ssl-redirect: '443'
    
    autoscaling:
      enabled: true
      minReplicas: 2
      maxReplicas: 5
    

    Note, I still get these WARN logs:

    2022-10-06 09:17:52,855 WARN  [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
    2022-10-06 09:17:53,026 WARN  [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled
    

    But when I login, delete one of the pods and refresh the page I'm still logged in (tested deleting both pods). So I guess the cache is work somehow anyway.