Keycloak configuration : try to understand Epiphany version 2.0.4

[MurugaAzure]

Hello @przemyslavic,

Initially we configured keycloak at "kind: configuration/applications" in yaml file. It was created a namespace in master cluster vm.
But latest version 2.0.4, it is separate configuration like "kind: configuration/keycloak", so it was not created a namespace in master cluster vm.

Note: I have created separate PostgreSQL Server in cloud so no need to create a component via Epiphany.

Configuration:

kind: configuration/keycloak
title: Keycloak Config
name: default
specification:
namespace: #{keycloak-namespace}#
database:
epiphany_managed: false
image_registry:
use_local: true
chart_values:
fullnameOverride: keycloak
replicas: #{keycloak-pod-replica}#
image:
repository: quay.io/keycloak/keycloak
tag: 19.0.2
secrets:
admin-credentials:
type: kubernetes.io/basic-auth
stringData:
username: #{keycloak-master-user}#
password: #{keycloak-master-pass}#
service:
httpsNodePort: #{keycloak-port}#
database:
vendor: postgres
name: #{keycloak-service-name}#
hostname: #{keycloak-db-host}#
database: #{keycloak-db-name}#
port: 5432
username: #{keycloak-db-user}#
password: #{keycloak-db-pass}#
version: 2.0.4

Could you help me?

[przemyslavic]

@MurugaAzure
Please use code snippets/blocks to make it more readable.
The way of installing Keycloak has been changed in v2.0.2 and since then there have been no changes in this area.
By default Keycloak is disabled, to enable it use the following code snippet (as described in the documentation):

---
kind: configuration/features
title: "Features to be enabled/disabled"
name: default
provider: <provider>
specification:
  features:
    - _merge: true
    - name: keycloak
      enabled: true

Then you can configure it according to your needs by modifying kind: configuration/keycloak document in your input data yaml file.

[MurugaAzure]

Hello @przemyslavic ,

I am facing issue. Run Ansible failed. could you please help me.

Error:

2023-01-30T14:41:44.4667699Z 14:41:44 INFO cli.src.ansible.AnsibleCommand - TASK [preflight : Keycloak checks] *********************************************�[0m
2023-01-30T14:41:44.9801525Z 14:41:44 INFO cli.src.ansible.AnsibleCommand - �[0;36mincluded: /shared/build/epiph-test-cluster/ansible/roles/keycloak/tasks/preflight/apply.yml for test-epiph-test-cluster-kubernetes-master-vm-0, test-epiph-test-cluster-kubernetes-node-vm-0, test-epiph-test-cluster-kubernetes-node-vm-1, test-epiph-test-cluster-kubernetes-node-vm-2, test-epiph-test-cluster-kubernetes-node-vm-3, test-epiph-test-cluster-logging-vm-0, test-epiph-test-cluster-monitoring-vm-0, test-epiph-test-cluster-kafka-vm-0, test-epiph-test-cluster-repository-vm-0�[0m�[0m
2023-01-30T14:41:45.0107412Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0m
2023-01-30T14:41:45.0117848Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - TASK [preflight : Include vars from keycloak role] *****************************�[0m
2023-01-30T14:41:45.1425582Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0;32mok: [test-epiph-test-cluster-kubernetes-master-vm-0 -> localhost]�[0m�[0m
2023-01-30T14:41:45.1621119Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0m
2023-01-30T14:41:45.1632331Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - TASK [preflight : Ensure postgresql is provided] *******************************�[0m
2023-01-30T14:41:45.2103321Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0;31mfatal: [test-epiph-test-cluster-kubernetes-master-vm-0 -> localhost]: FAILED! => {"assertion": "groups.postgresql is defined", "changed": false, "evaluated_to": false, "msg": "At least one postgresql component has to be defined"}�[0m�[0m
2023-01-30T14:41:45.2119488Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0m
2023-01-30T14:41:45.2121134Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - NO MORE HOSTS LEFT *************************************************************�[0m
2023-01-30T14:41:45.2144722Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - �[0m
2023-01-30T14:41:45.2146450Z 14:41:45 INFO cli.src.ansible.AnsibleCommand - PLAY RECAP *********************************************************************�[0m

Configuration:

kind: configuration/features
title: Features to be enabled/disabled
name: default
specification:
features:

• _merge: true
• name: repository
  enabled: true
• name: kubernetes-master
  enabled: true
• name: kubernetes-node
  enabled: true
• name: logging
  enabled: true
• name: opensearch
  enabled: true
• name: opensearch-dashboards
  enabled: true
• name: filebeat
  enabled: true
• name: prometheus
  enabled: true
• name: grafana
  enabled: true
• name: keycloak
  enabled: true
  version: 2.0.4
  provider: azure

---

kind: configuration/keycloak
title: Keycloak Config
name: default
specification:
namespace: #{keycloak-namespace}#
database:
epiphany_managed: true
image_registry:
use_local: true
chart_values:
fullnameOverride: keycloak
replicas: #{keycloak-pod-replica}#
image:
repository: quay.io/keycloak/keycloak
tag: 19.0.2
secrets:
admin-credentials:
type: kubernetes.io/basic-auth
stringData:
username: #{keycloak-master-user}#
password: #{keycloak-master-pass}#
service:
type: NodePort
httpsNodePort: #{keycloak-port}#
dbchecker:
enabled: false
image:
repository: docker.io/busybox
tag: '1.32'
database:
vendor: postgres
name: #{keycloak-service-name}#
hostname: #{keycloak-db-host}#
database: #{keycloak-db-name}#
port: 5432
username: #{keycloak-db-user}#
password: #{keycloak-db-pass}#
proxy:
enabled: true
mode: reencrypt
metrics:
enabled: false
http:
relativePath: /auth
version: 2.0.4
provider: azure

[MurugaAzure]

Sure @przemyslavic , I will use code block.

I will try to change the epiphany_managed parameter to "false".

[MurugaAzure]

Hello @przemyslavic ,

I am facing issue.

Configuration:

```
kind: epiphany-cluster
title: Epiphany cluster Config
provider: azure
name: default
specification:
  prefix: relcare
  name: #{env}#-cluster
  admin_user:
    name: operations
    key_path: /shared/#{env}#/.ssh/id_rsa
  cloud:
    k8s_as_cloud_service: false
    subscription_name: #{prd-subscription-name}#
    vnet_address_pool: #{application-vnet-cidr}#
    use_public_ips: false
    use_service_principal: true
    region: #{prd-region}#
  components:
    kubernetes_master:
      count: 1
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-k8s-master1
    kubernetes_node:
      count: #{worker-node-count}#
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-k8s-node 
    logging:
      count: 1
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-logging
    monitoring:
      count: 1
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-monitoring
    kafka:
      count: 1
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-kafka   
    repository:
      count: 1
      subnets:
        - address_pool: #{application-vnet-cidr}#
      machines: default-repository
    load_balancer:
      count: 0
    postgresql:
      count: 0
    single_machine:
      count: 0 
version: 2.0.4
---
kind: configuration/features
title: Features to be enabled/disabled
name: default
specification:
  features:
  - _merge: true
  - name: repository
    enabled: true
  - name: kubernetes-master
    enabled: true
  - name: kubernetes-node
    enabled: true
  - name: logging
    enabled: true
  - name: opensearch
    enabled: true
  - name: opensearch-dashboards
    enabled: true
  - name: prometheus
    enabled: true
  - name: grafana
    enabled: true
  - name: keycloak
    enabled: true
version: 2.0.4
provider: azure
---
kind: configuration/feature-mappings
title: Feature mapping to components
name: default
specification:
  mappings:
    kafka:
    - zookeeper
    - jmx-exporter
    - kafka
    - kafka-exporter
    - node-exporter
    - filebeat
    - firewall
    rabbitmq:
    - rabbitmq
    - node-exporter
    - filebeat
    - firewall
    logging:
    - logging
    - opensearch-dashboards
    - node-exporter
    - filebeat
    - firewall
    load_balancer:
    - haproxy
    - node-exporter
    - filebeat
    - firewall
    monitoring:
    - prometheus
    - grafana
    - node-exporter
    - filebeat
    - firewall
    postgresql:
    - postgresql
    - postgres-exporter
    - node-exporter
    - filebeat
    - firewall
    custom:
    - repository
    - image-registry
    - kubernetes-master
    - node-exporter
    - filebeat
    - rabbitmq
    - postgresql
    - prometheus
    - grafana
    - node-exporter
    - logging
    - firewall
    - rook
    single_machine:
    - repository
    - image-registry
    - kubernetes-master
    - helm
    - applications
    - keycloak
    - rabbitmq
    - postgresql
    - firewall
    - rook
    kubernetes_master:
    - kubernetes-master
    - helm
    - applications
    - keycloak
    - rook
    - node-exporter
    - filebeat
    - firewall
    kubernetes_node:
    - kubernetes-node
    - node-exporter
    - filebeat
    - firewall
    opensearch:
    - opensearch
    - node-exporter
    - filebeat
    - firewall
    repository:
    - repository
    - image-registry
    - firewall
    - filebeat
    - node-exporter
version: 2.0.4
provider: azure
---
kind: configuration/logging
title: Logging Config
name: default
specification:
  cluster_name: EpiphanyOpenSearch
  opensearch_os_user: opensearch
  opensearch_os_group: opensearch
  admin_password: PASSWORD_TO_CHANGE
  kibanaserver_password: PASSWORD_TO_CHANGE
  filebeatservice_password: PASSWORD_TO_CHANGE
  demo_users_to_remove:
  - kibanaro
  - readall
  - snapshotrestore
  - logstash
  paths:
    opensearch_home: /usr/share/opensearch
    opensearch_conf_dir: /usr/share/opensearch/config
    opensearch_log_dir: /var/log/opensearch
    opensearch_snapshots_dir: /var/lib/opensearch-snapshots
    opensearch_data_dir: /var/lib/opensearch
    opensearch_perftop_dir: /usr/share/opensearch/perftop
  jvm_options:
    Xmx: 1g
  opensearch_security:
    audit:
      type: internal_opensearch
    ssl:
      transport:
        enforce_hostname_verification: true
version: 2.0.4
provider: azure
---
kind: configuration/opensearch-dashboards
title: OpenSearch-Dashboards
name: default
specification:
  dashboards_os_user: opensearch_dashboards
  dashboards_os_group: opensearch_dashboards
  paths:
    dashboards_home: /usr/share/opensearch-dashboards
    dashboards_conf_dir: /usr/share/opensearch-dashboards/config
    dashboards_plugin_bin_path: /usr/share/opensearch-dashboards/bin/opensearch-dashboards-plugin
    dashboards_log_dir: /var/log/opensearch-dashboards
version: 2.0.4
provider: azure
---
kind: configuration/prometheus
title: Prometheus
name: default
specification:
  config_directory: /etc/prometheus
  storage:
    data_directory: /var/lib/prometheus
  config_flags:
  - --config.file=/etc/prometheus/prometheus.yml
  - --storage.tsdb.path=/var/lib/prometheus
  - --storage.tsdb.retention.time=180d
  - --storage.tsdb.retention.size=20GB
  - --web.console.libraries=/etc/prometheus/console_libraries
  - --web.console.templates=/etc/prometheus/consoles
  - --web.listen-address=0.0.0.0:9090
  - --web.enable-admin-api
  metrics_path: /metrics
  scrape_interval: 15s
  scrape_timeout: 10s
  evaluation_interval: 10s
  remote_write: []
  remote_read: []
  alertmanager:
    enable: false
    alert_rules:
      common: true
      container: false
      kafka: false
      node: false
      postgresql: false
      prometheus: false
version: 2.0.4
provider: azure
---
kind: configuration/grafana
title: Grafana
name: default
specification:
  grafana_logs_dir: /var/log/grafana
  grafana_data_dir: /var/lib/grafana
  grafana_address: 0.0.0.0
  grafana_port: 3000
  grafana_provisioning_synced: false
  grafana_url: https://0.0.0.0:3000
  grafana_server:
    protocol: https
    enforce_domain: false
    socket: ''
    cert_key: /etc/grafana/ssl/grafana_key.key
    cert_file: /etc/grafana/ssl/grafana_cert.pem
    enable_gzip: false
    static_root_path: public
    router_logging: false
  grafana_security:
    admin_user: admin
    admin_password: PASSWORD_TO_CHANGE
  grafana_database:
    type: sqlite3
  grafana_external_dashboards: []
  grafana_online_dashboards: []
  grafana_dashboards_dir: dashboards
  grafana_welcome_email_on_sign_up: false
  grafana_users:
    allow_sign_up: false
    auto_assign_org_role: Viewer
    default_theme: dark
  grafana_auth: {}
  grafana_ldap: {}
  grafana_session: {}
  grafana_analytics: {}
  grafana_smtp: {}
  grafana_alerting:
    execute_alerts: true
  grafana_log: {}
  grafana_metrics: {}
  grafana_tracing: {}
  grafana_snapshots: {}
  grafana_image_storage: {}
  grafana_plugins: []
  grafana_alert_notifications: []
  grafana_datasources:
  - name: Prometheus
    type: prometheus
    access: proxy
    url: http://localhost:9090
    basicAuth: false
    basicAuthUser: ''
    basicAuthPassword: ''
    isDefault: true
    editable: true
    jsonData:
      tlsAuth: false
      tlsAuthWithCACert: false
      tlsSkipVerify: true
  grafana_api_keys: []
  grafana_logging:
    log_rotate: true
    daily_rotate: true
    max_days: 7
version: 2.0.4
provider: azure
---
kind: configuration/keycloak
title: Keycloak Config
name: default
specification:
  namespace: #{keycloak-namespace}#
  database:
    epiphany_managed: false
  image_registry:
    use_local: true
  chart_values:
    fullnameOverride: keycloak
    replicas: #{keycloak-pod-replica}#
    image:
      repository: quay.io/keycloak/keycloak
      tag: 19.0.2
    secrets:
      admin-credentials:
        type: kubernetes.io/basic-auth
        stringData:
          username: #{keycloak-master-user}#
          password: #{keycloak-master-pass}#
    service:
      type: NodePort
      httpsNodePort: #{keycloak-port}#
    dbchecker:
      enabled: false
      image:
        repository: docker.io/busybox
        tag: '1.32'
    database:
      vendor: postgres
      name: #{keycloak-service-name}#
      hostname: #{keycloak-db-host}#
      database: #{keycloak-db-name}#
      port: 5432
      username: #{keycloak-db-user}#
      password: #{keycloak-db-pass}#
    proxy:
      enabled: true
      mode: reencrypt
    metrics:
      enabled: false
    http:
      relativePath: /auth
version: 2.0.4
provider: azure
---
kind: configuration/opensearch
title: OpenSearch Config
name: default
specification:
  cluster_name: EpiphanyOpenSearch
  opensearch_os_user: opensearch
  opensearch_os_group: opensearch
  admin_password: PASSWORD_TO_CHANGE
  kibanaserver_password: PASSWORD_TO_CHANGE
  demo_users_to_remove:
  - kibanaro
  - readall
  - snapshotrestore
  - logstash
  - kibanaserver
  paths:
    opensearch_home: /usr/share/opensearch
    opensearch_conf_dir: /usr/share/opensearch/config
    opensearch_log_dir: /var/log/opensearch
    opensearch_snapshots_dir: /var/lib/opensearch-snapshots
    opensearch_data_dir: /var/lib/opensearch
    opensearch_perftop_dir: /usr/share/opensearch/perftop
  jvm_options:
    Xmx: 1g
  opensearch_security:
    audit:
      type: internal_opensearch
    ssl:
      transport:
        enforce_hostname_verification: true
version: 2.0.4
provider: azure
---
kind: configuration/repository
title: Epiphany requirements repository
name: default
specification:
  description: Local repository of binaries required to install Epiphany
  download_done_flag_expire_minutes: 120
  apache_epirepo_path: /var/www/html/epirepo
  teardown:
    disable_http_server: true
    remove:
      files: false
      helm_charts: false
      images: false
      packages: false
version: 2.0.4
provider: azure
---
kind: infrastructure/virtual-machine
provider: azure
name: default-k8s-master
specification:
  size: #{master-size}#
  storage_os_disk:
    disk_size_gb: 64  
version: 2.0.4
---
kind: infrastructure/virtual-machine
title: Virtual Machine Infra
provider: azure
name: default-monitoring
specification:
  size: #{monitoring-size}#
  storage_os_disk:
    disk_size_gb: 64
version: 2.0.4
---
kind: infrastructure/virtual-machine
title: Virtual Machine Infra
provider: azure
name: default-logging
specification:
  size: #{logging-size}#
  storage_os_disk:
    disk_size_gb: 64
version: 2.0.4
---
kind: infrastructure/virtual-machine
title: Virtual Machine Infra
provider: azure
name: default-kafka
specification:
  size: #{kafka-size}#
  storage_os_disk:
    disk_size_gb: 64
version: 2.0.4
---
kind: infrastructure/virtual-machine
title: Virtual Machine Infra
provider: azure
name: default-repository
specification:
  size: #{repository-size}#
  storage_os_disk:
    disk_size_gb: 64
version: 2.0.4
```

Error:

```
2023-01-30T15:45:40.0387286Z 15:45:40 INFO cli.src.ansible.AnsibleCommand - TASK [keycloak : Install Keycloak with Helm chart] *****************************�[0m
2023-01-30T15:50:44.8637167Z 15:50:44 INFO cli.src.ansible.AnsibleCommand - �[0;31mfatal: [127.0.0.1]: FAILED! => {"changed": true, "cmd": ["helm", "upgrade", "keycloak", "/tmp/keycloakx-1.6.1.tgz", "-f", "/shared/build/epiph-test-cluster/vault//keycloak-chart-values.yml", "-n", "sim-test-keyclock-auth", "--atomic", "--create-namespace", "--install"], "delta": "0:05:04.419209", "end": "2023-01-30 15:50:44.837491", "msg": "non-zero return code", "rc": 1, "start": "2023-01-30 15:45:40.418282", "stderr": "Error: release keycloak failed, and has been uninstalled due to atomic being set: timed out waiting for the condition", "stderr_lines": ["Error: release keycloak failed, and has been uninstalled due to atomic being set: timed out waiting for the condition"], "stdout": "Release \"keycloak\" does not exist. Installing it now.", "stdout_lines": ["Release \"keycloak\" does not exist. Installing it now."]}�[0m�[0m
2023-01-30T15:50:44.8666041Z 15:50:44 INFO cli.src.ansible.AnsibleCommand - �[0m
2023-01-30T15:50:44.8669976Z 15:50:44 INFO cli.src.ansible.AnsibleCommand - PLAY RECAP *********************************************************************�[0m
2023-01-30T15:50:44.8679032Z 15:50:44 INFO cli.src.ansible.AnsibleCommand - �[0;31m127.0.0.1�[0m                  : �[0;32mok=3   �[0m �[0;33mchanged=1   �[0m unreachable=0    �[0;31mfailed=1   �[0m �[0;36mskipped=2   �[0m rescued=0    ignored=0   �[0m
2023-01-30T15:50:44.8685997Z 15:50:44 INFO cli.src.ansible.AnsibleCommand - �[0m

```

[przemyslavic]

That doesn't say much (looks like it timed out waiting for some condition and then got uninstalled). I'd suggest running the failed command manually on k8s master host:
helm upgrade keycloak /tmp/keycloakx-1.6.1.tgz -f /shared/build/epiph-test-cluster/vault/keycloak-chart-values.yml -n sim-test-keyclock-auth --atomic --create-namespace --install with additional --debug flag. Make sure that the files keycloakx-1.6.1.tgz and keycloak-chart-values.yml exist in the specified location (most probably you will have to copy keycloak-chart-values.yml file from your shared directory to some temporary destination on k8s master node). Then you should get a more detailed error explaining why the installation failed.
BTW is PostgreSQL server reachable from k8s hosts?

[MurugaAzure]

Hello @przemyslavic,

I will verify the file from shared directory.

PostgreSQL server is reachable from K8s hosts. Let me check it.

Thanks for your support.

[MurugaAzure]

Thanks @przemyslavic.

Keycloak configuration was created successfully via Pipeline. Namespace has created in master cluster vm.

Thank you so much for your support.