Migration to Quarkus
Keycloak v17 is changing their runtime from Wildfly to Quarkus. This brings a complete new way of how the Keycloak container has to be deployed (Quarkus based Keycloak Image vs the Wildfly based image) and parameterized. While Wildfly is a full-fledged application server for Java, Quarkus is a Kubernetes Native Java stack.
The Keycloak default image requires a "build" before startup.
This can be automatized using the
--auto-build, which is the default in the component.
This additional step can be removed by creating a customized Keycloak image.
KC_HOSTNAMEcontaining the FQDN of the Keycloak service. Verification can be turned off by using the parameters
--hostname-strict-https=false. However, for production the hostname verification should be turned on!
KC_HTTP_RELATIVE_PATHin Keycloak is
/by default. However, the Helm chart contains the default value of
/auth, so for upgrades there is no breaking change.
The Wildfily container did automatically create a truststore file out of PEM files existing in
/etc/x509/https. Now the public and private key file must be defined in variables, for example
KEYCLOAK_STATISTICSis replaced by
JGROUPS_DISCOVERY_PROPERTIESare replaced by
JAVA_OPTS=-Djgroups.dns.query=keycloakx-headless(see Helm chart documentation).
PROXY_ADDRESS_FORWARDINGremoved, see Using a reverse proxy and
KC_PROXYfor more information. If
KC_PROXYis set to a value of
X-Forwarded-HostHTTP headers are used by Keycloak (see Source Code).
Theme path has changed from
CACHE_OWNERS_COUNThave no direct equivalent in the Quarkus setup. A cache replica/owner number of
>= 2is required to preserve the Infinispan cache over single Keycloak pod restarts. The Wildfly default value of those variables has been
1and defined the amount of replicas/owners for a specific cache. Now the default in the Quarkus Setup is "Each distributed cache has two owners per default, which means that two nodes have a copy of the specific cache entries". A custom Infinispan configuration file can be configured using the environment variable
KC_CACHE_CONFIG_FILEto override the default.