How to disable/overwrite default keycloak deployment container args #11742

m33li5 · 2022-04-28T12:33:18Z

m33li5
Apr 28, 2022

By default the operator sets the following args for a keycloak deployment:

kind: Deployment
...
spec:
  template:
    spec:                                                                                      
      containers:                     
      - args:         
        - start    
        - --auto-build

But I build my own custom kc container and don't need these args and would like to be able to change them.
I tried using the unsupported: section (docs) to set args to [] or null:

kind: Keycloak
...
spec:
  unsupported:
     podTemplate:
       spec:
         containers:
           - args: [] # also tried 'null'

But this did not work. Any ideas on how to achieve this?

m33li5 · 2022-04-29T07:46:28Z

m33li5
Apr 29, 2022
Author

It seems my issue should be solved by this: #10793, but when I use a custom image the --auto-build arg is still set by the operator.
@andreaTP any ideas? I've deployed the operator from tag 18.0.0

0 replies

andreaTP · 2022-04-29T11:24:11Z

andreaTP
Apr 29, 2022

Hi @m33li5 and thanks for your interest!
I'm failing to reproduce the situation you mentioned, those are the steps I'm following:

restart a fresh minikube instance:

minikube stop && minikube delete && minikube start --driver=docker --memory 8192 --cpus 3

install the keycloak-operator 18.0.0:

kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/18.0.0/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/18.0.0/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/18.0.0/kubernetes/kubernetes.yml

Deploy a Keycloak CR with a custom image:

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: example-kc
spec:
  instances: 1
  hostname: INSECURE-DISABLE
  tlsSecret: INSECURE-DISABLE
  image: keycloak:123

Check the expected output:

kubectl get deployments example-kc -o yaml | yq '.spec.template.spec.containers[0].args'
$ - start

Deploy a Keycloak CR without custom image but removing auto-build using pod-template:

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: example-kc
spec:
  instances: 1
  hostname: INSECURE-DISABLE
  tlsSecret: INSECURE-DISABLE
  unsupported:
    podTemplate:
      spec:
        containers:
          - args:
              - start

Check the expected output again:

kubectl get deployments example-kc -o yaml | yq '.spec.template.spec.containers[0].args'
$ - start

Would you mind to doublecheck those proposed approaches?
Is there any invariance in your environment that can influence it?
Do you see any issue in the keycloak-operator logs?

2 replies

m33li5 Apr 29, 2022
Author

Ahaa! I got it working now.

I was setting the custom image value in the operator deployment yaml here, but once I set the custom image in the kind: Keycloak as your example above, then it did get rid of --auto-build. The start arg still remained.

But I figured out a way to also remove all the args, including start. So. even though [] and null don't work, then I could just set it to empty string "":

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: example-kc
spec:
  instances: 1
  hostname: INSECURE-DISABLE
  tlsSecret: INSECURE-DISABLE
  unsupported:
    podTemplate:
      spec:
        containers:
          - args:
              - ""

andreaTP Apr 29, 2022

Good to hear that you have a viable workaround!

iammuho · 2022-06-23T08:06:43Z

iammuho
Jun 23, 2022

Hey people,

When I just want to define only 1 override under containers it's working as expected, but when I want 2 or more operator gives me error.

Example:

unsupported:
    podTemplate:
      spec:
        containers:
          - args:
              - start
              - --auto-build
              - -Djavax.net.ssl.keyStore=/keystore/keystore.jks
              - -Djavax.net.ssl.keyStorePassword=rnZOFTkz5P6Z5TUj2fgu
          - volumeMounts:
              - name: cert-keystore
                mountPath: "/keystore/"
                readOnly: true
        volumes:
          - name: cert-keystore
            configMap:
              name: cert-keystore

and my operator:

2022-06-23 08:03:14,860 ERROR [io.jav.ope.pro.eve.ReconciliationDispatcher] (EventHandler-keycloakcontroller) Error during event processing ExecutionScope{ resource id: CustomResourceID{name='keycloak', namespace='keycloak'}, version: 134987643} failed.: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://172.20.0.1/apis/apps/v1/namespaces/keycloak/deployments. Message: Deployment.apps "keycloak" is invalid: [spec.template.spec.containers[1].name: Required value, spec.template.spec.containers[1].image: Required value]. Received status: Status(apiVersion=v1, code=422, details=StatusDetails(causes=[StatusCause(field=spec.template.spec.containers[1].name, message=Required value, reason=FieldValueRequired, additionalProperties={}), StatusCause(field=spec.template.spec.containers[1].image, message=Required value, reason=FieldValueRequired, additionalProperties={})], group=apps, kind=Deployment, name=keycloak, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=Deployment.apps "keycloak" is invalid: [spec.template.spec.containers[1].name: Required value, spec.template.spec.containers[1].image: Required value], metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Invalid, status=Failure, additionalProperties={}).
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:682)
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:661)
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:612)
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:555)
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:518)
	at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleCreate(OperationSupport.java:305)
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:644)
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleCreate(BaseOperation.java:83)
	at io.fabric8.kubernetes.client.dsl.base.CreateOnlyResourceOperation.create(CreateOnlyResourceOperation.java:61)
	at io.fabric8.kubernetes.client.utils.CreateOrReplaceHelper.createOrReplace(CreateOrReplaceHelper.java:48)
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.createOrReplace(BaseOperation.java:318)
	at io.fabric8.kubernetes.client.dsl.base.BaseOperation.createOrReplace(BaseOperation.java:83)
	at io.fabric8.kubernetes.client.dsl.internal.NamespaceVisitFromServerGetWatchDeleteRecreateWaitApplicableImpl.createOrReplace(NamespaceVisitFromServerGetWatchDeleteRecreateWaitApplicableImpl.java:105)
	at io.fabric8.kubernetes.client.dsl.internal.NamespaceVisitFromServerGetWatchDeleteRecreateWaitApplicableImpl.createOrReplace(NamespaceVisitFromServerGetWatchDeleteRecreateWaitApplicableImpl.java:63)
	at org.keycloak.operator.OperatorManagedResource.lambda$createOrUpdateReconciled$0(OperatorManagedResource.java:56)

What should I do to define both volumemount and args?

2 replies

andreaTP Jun 23, 2022

Hi @iammuho , I do believe that there is an incorrect indentation in your yaml, the error message is saying that:

spec.template.spec.containers[1].name: Required value

so, it means that you are defining the second element in the array of containers.
e.g. volumeMounts should be within the array element starting with - args and not at the same level.

andreaTP Jun 23, 2022

@iammuho this should be the correct yaml:

unsupported:
    podTemplate:
      spec:
        containers:
          - args:
              - start
              - --auto-build
              - -Djavax.net.ssl.keyStore=/keystore/keystore.jks
              - -Djavax.net.ssl.keyStorePassword=rnZOFTkz5P6Z5TUj2fgu
            volumeMounts:
              - name: cert-keystore
                mountPath: "/keystore/"
                readOnly: true
        volumes:
          - name: cert-keystore
            configMap:
              name: cert-keystore

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to disable/overwrite default keycloak deployment container args #11742

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to disable/overwrite default keycloak deployment container args #11742

Uh oh!

m33li5 Apr 28, 2022

Replies: 3 comments · 4 replies

Uh oh!

m33li5 Apr 29, 2022 Author

Uh oh!

andreaTP Apr 29, 2022

Uh oh!

m33li5 Apr 29, 2022 Author

Uh oh!

andreaTP Apr 29, 2022

Uh oh!

iammuho Jun 23, 2022

Uh oh!

andreaTP Jun 23, 2022

Uh oh!

andreaTP Jun 23, 2022

m33li5
Apr 28, 2022

Replies: 3 comments 4 replies

m33li5
Apr 29, 2022
Author

andreaTP
Apr 29, 2022

m33li5 Apr 29, 2022
Author

iammuho
Jun 23, 2022