feat(keycloak): add shared Keycloak instance - #2
Open
JSisques wants to merge 1 commit into
Open
Conversation
…re services account-api's Keycloak used to live in its own docker-compose.yml because it had exactly one consumer; now that more than one service needs it, it moves here alongside the other shared infra (Postgres, Kafka, Redis, OTel). Realms are imported via the Admin REST API by a one-shot keycloak-realm-import job, not Keycloak's own --import-realm startup flag: that flag reliably crashes Keycloak 26.0 on boot with "ERROR: Session not bound to a realm" right after logging the realm import as successful (reproduced repeatedly while adding this service; see upstream keycloak/keycloak#33637 and #34673, unresolved as of image 26.0.8).
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
quay.io/keycloak/keycloak:26.0) to the stack — it used to live only inaccount-api's owndocker-compose.ymlbecause it had a single consumer; now that more than one service needs it, it's centralized here like Postgres/Kafka/Redis/OTel.docker/keycloak/realms/(mirrorsdocker/postgres/init-db.sh's one-database-per-service pattern) and imported via a one-shotkeycloak-realm-importjob that calls the Admin REST API.account-api's existing realm/client todocker/keycloak/realms/account-api-realm.json(companion PR removes the duplicate service fromaccount-api's own compose file).Why not Keycloak's own
--import-realmflagstart-dev --import-realmreliably crashes Keycloak 26.0 on boot withERROR: Session not bound to a realm, right after logging the realm as successfully imported. Reproduced repeatedly while adding this service, both with and without a persistent data volume, and both with and without the service-account role-mapping block in the realm JSON. Matches unresolved upstream reports: keycloak/keycloak#33637 and #34673. Worked around by starting Keycloak plain (start-dev) and importing realms after boot viaPOST /admin/realmsfrom a separatecurlimages/curljob instead — seedocker/keycloak/import-realms.shfor details, and the README's "Keycloak" section for the full writeup.No persistent data volume for Keycloak, by design — see the same README section.
Test plan
docker compose config -qdocker compose up -d— full stack up, every service healthy/running,keycloak-realm-importexits 0,keycloaknever restartscurl http://localhost:8084/realms/sisques-account/.well-known/openid-configuration→ 200 after importdocker compose up -d keycloak-realm-importagainst an already-imported realm returns 409 and is treated as success (idempotent)docker compose down -v— clean teardown, no dangling volumes