Skip to content

Keycloak container fails to start in Azure Container Apps #6004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
1 task done
julioct opened this issue Sep 28, 2024 · 12 comments · May be fixed by #8478
Open
1 task done

Keycloak container fails to start in Azure Container Apps #6004

julioct opened this issue Sep 28, 2024 · 12 comments · May be fixed by #8478
Labels
area-integrations Issues pertaining to Aspire Integrations packages keycloak Issues related to keycloack integrations
Milestone
Backlog

Comments

@julioct
Copy link
Contributor

julioct commented Sep 28, 2024

Is there an existing issue for this?

  • I have searched the existing issues

Describe the bug

Deploying a container provisioned via the Keycloak integration won't start in Azure Container Apps (ACA).

ACA will try to activate it, but it continuously fails.

The container reports this in the logs:

Key material not provided to setup HTTPS. Please configure your keys/certificates or start the server in development mode.

Expected Behavior

Keycloak should successfully deploy to ACA.

Steps To Reproduce

  1. Create a .NET Aspire app
  2. Add the Keycloak AppHost integration: via Aspire.Hosting.Keycloak NuGet package
  3. Add the Keycloak integration to the AppHost model:
var builder = DistributedApplication.CreateBuilder(args);

var keycloak = builder.AddKeycloak("keycloak", 8080);

builder.Build().Run();
  1. Deploy via azd up
  2. The container never starts in ACA:

image

Exceptions (if any)

Key material not provided to setup HTTPS. Please configure your keys/certificates or start the server in development mode.

.NET Version info

.NET SDK:
Version: 8.0.400
Commit: 36fe6dda56
Workload version: 8.0.400-manifests.2772ffde
MSBuild version: 17.11.3+0c8610977

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\8.0.400\

.NET workloads installed:
Configured to use loose manifests when installing new manifests.
[aspire]
Installation Source: SDK 8.0.400, VS 17.11.35303.130
Manifest Version: 8.2.1/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.aspire\8.2.1\WorkloadManifest.json
Install Type: Msi

Host:
Version: 8.0.8
Architecture: x64
Commit: 08338fcaa5

.NET SDKs installed:
8.0.108 [C:\Program Files\dotnet\sdk]
8.0.206 [C:\Program Files\dotnet\sdk]
8.0.304 [C:\Program Files\dotnet\sdk]
8.0.400 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 8.0.6 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Learn more:
https://aka.ms/dotnet/info

Download .NET:
https://aka.ms/dotnet/download

Anything else?

When deploying to Azure, the Keycloak integration adds just this parameter:

start

However to run Keycloak in prod requires multiple other parameters as described here.

Something like this:

podman|docker run --name mykeycloak -p 8080:8080 \
        -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=change_me \
        quay.io/keycloak/keycloak:latest \
        start \
        --db=postgres --features=token-exchange \
        --db-url=<JDBC-URL> --db-username=<DB-USER> --db-password=<DB-PASSWORD> \
        --https-key-store-file=<file> --https-key-store-password=<password>
@davidfowl davidfowl added area-integrations Issues pertaining to Aspire Integrations packages feature keycloak Issues related to keycloack integrations labels Sep 28, 2024
@davidfowl davidfowl removed the feature label Oct 16, 2024
@davpodda
Copy link

davpodda commented Oct 31, 2024 •
edited
Loading

Hi have you any solution? I have the same problem

@sandves
Copy link

sandves commented Jan 3, 2025

Any updates on this? Would be really helpful with an example on how to do run Keycloak in Aspire in a production ready setup.

@eerhardt
Copy link
Member

@DamianEdwards - do we have any keycloak contacts we could ask about this issue?

@eerhardt eerhardt added this to the Backlog milestone Jan 14, 2025
@DamianEdwards
Copy link
Member

I don't think we need a contact. The Keycloak integration is still in preview. In order for it to be successfully started in production mode it requires extra configuration which the hosting integration currently doesn't expose modeling for in a first-class way, e.g. the HTTPS certificate information. When run during local development we configure it to run in dev mode which removes these requirements.

The work here is to update the Keycloak hosting integration to expose appropriate API that enables configuring it for production use when deployed. Whether we can make it work by default (with generated passwords, certificates/keys, etc.) is still an open question.

@LeakeyMaina
Copy link

Has anyone managed to get this working?

@rcolombo-cdesign
Copy link

Hello, i deployed a Keycloak instance to an Azure Container App, and i do get this problem. I understand we have to somehow give Keycloak the references to the SSL certificate for it to work with HTTPS.

But does this still stands with an Ingress in front of the container? I expect that with an Ingress service configured for the container, i can simply run the Keycloak using HTTP mode, and even still for the connections outside the ACA, it will still serve everything in HTTPS, is this correct?

If so, one point of attention, is that the Keycloak management interface calls some iframes, for which i get a CORS error (mixed http/https content)

@DamianEdwards
Copy link
Member

But does this still stands with an Ingress in front of the container? I expect that with an Ingress service configured for the container, i can simply run the Keycloak using HTTP mode, and even still for the connections outside the ACA, it will still serve everything in HTTPS, is this correct?

I think you can but you need to configure it specifically for running behind a reverse proxy, see https://www.keycloak.org/server/reverseproxy

@YandyZaldivar
Copy link

I would also be interested in any workaround while the integration is still in preview.

@andrekiba
Copy link

andrekiba commented Mar 6, 2025 •
edited
Loading

I’m also exploring the possibility to run Keycloak in plain http behind Envoy in container apps…so basically with the tls termination at the proxy…
You can set the hostname environment variable with the fqdn of your container apps
https://www.keycloak.org/server/all-config#category-hostname_v2
and then disable https with the http-enabled to true
https://www.keycloak.org/server/all-config#category-http

@anderly
Copy link

anderly commented Apr 1, 2025 •
edited
Loading

@YandyZaldivar @andrekiba

I was able to put together a working version of keycloak container that runs on Azure Container Apps and supports custom domains. Here's the repo for anyone looking for a workaround: https://github.com/anderly/keycloak-azure-container-apps

Key elements of the config that got it to work from the Dockerfile:

ENV KC_HTTP_ENABLED=true
ENV KC_PROXY-HEADERS=xforwarded
ENV KC_HOSTNAME-STRICT=false

Technically, KC_HOSTNAME-STRICT doesn't have to be false and shouldn't be for prod, but if it's not, KC_HOSTNAME also has to be provided and need to match the ACA container url or a configured custom domain.

If these env vars can be passed to the standard quay keycloak image for Aspire deployment to ACA, then it should be able to work.

Main reason I went with a custom image is I have it setup where I can preload themes, realms, providers and custom config.

Working on a basic PR to Keycloak Hosting integration to see if I can get this effort started.

@anderly
Copy link

anderly commented Apr 1, 2025 •
edited
Loading

See #8478 for basic PR starting point for getting working in Azure Container Apps.

This was referenced Apr 1, 2025
Closed
Open
@ARSunray
Copy link

ARSunray commented May 8, 2025

Seems there is no solution to a problem while deploying keycloak in the container app,

"The TargetPort 8080 does not match any of the listening ports. container crashed"

Any solutiong, any one?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area-integrations Issues pertaining to Aspire Integrations packages keycloak Issues related to keycloack integrations
Projects
None yet
Milestone
Backlog
Development

Successfully merging a pull request may close this issue.

Add support for Keycloak deployment to ACA anderly/dotnet-aspire