[keycloak quarkus 18.0.0] what does the "random ports" using for? #12354

ncistyang · 2022-06-06T10:54:27Z

ncistyang
Jun 6, 2022

I found two random port on keycloak container，the ports usually greater than 30000. please see below screenshot

now there is security audit in progress in our company, so I need to find out what does the two random ports using for ? can them support tls protocol ?

anyone can kindly help?

please see below keycloak StatefulSet config file in kubernetes


apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/name: keycloak
  name: keycloak
  namespace: yg-cmp
spec:
  podManagementPolicy: Parallel
  replicas: 3
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/instance: keycloak
      app.kubernetes.io/name: keycloak
  serviceName: keycloak-headless
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: keycloak
        app.kubernetes.io/name: keycloak
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/component
                  operator: NotIn
                  values:
                  - test
                matchLabels:
                  app.kubernetes.io/instance: keycloak
                  app.kubernetes.io/name: keycloak
              topologyKey: failure-domain.beta.kubernetes.io/zone
            weight: 100
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/component
                operator: NotIn
                values:
                - test
              matchLabels:
                app.kubernetes.io/instance: keycloak
                app.kubernetes.io/name: keycloak
            topologyKey: kubernetes.io/hostname
      containers:
      - env:
        - name: KC_CACHE
          value: ispn
        - name: KC_CACHE_STACK
          value: kubernetes
        - name: KC_HTTP_ENABLED
          value: "true"
        - name: KC_HOSTNAME_STRICT
          value: "false"
        - name: KC_HTTPS_PORT
          value: "8443"
        - name: KC_HTTPS_PROTOCOLS
          value: TLSv1.3,TLSv1.2
        - name: KC_HTTPS_CLIENT_AUTH
          value: none
        - name: KC_LOG
          value: console,file
        - name: KC_PROXY
          value: edge
        - name: KC_LOG_LEVEL
          value: info
        - name: KC_DB_URL_PORT
          value: "3306"
        - name: KC_DB_USERNAME
          value: root
        - name: KC_DB_PASSWORD
          value: ****
        - name: KC_DB_URL_DATABASE
          value: keycloak
        - name: KC_DB_URL_HOST
          value: ****
        - name: KC_HTTPS_KEY_STORE_FILE
          value: /etc/keystore/server.jks
        - name: KC_HTTPS_KEY_STORE_PASSWORD
          value: ****
        image: quay.io/keycloak/keycloak:18.0.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /auth/health/live
            port: http
            scheme: HTTP
          initialDelaySeconds: 300
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        name: keycloak
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 7800
          name: jgroups
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /auth/health/ready
            port: http
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1

Answered by pedroigor

Jun 15, 2022

The only thing I can think of is JGroups. Did you try running the pod using a local cache to check if those ports are still there?

View full answer

abstractj · 2022-06-08T14:56:53Z

abstractj
Jun 8, 2022
Maintainer

@ncistyang could you please tell if Keycloak was started in development, or production mode?

2 replies

ncistyang Jun 8, 2022
Author

thanks for your replay , it's in production mode, please see below boot command

/opt/keycloak/bin/kc.sh start -Djgroups.dns.query=keycloak-headless.${POD_NAMESPACE}.svc.cluster.local \ -Djdk.tls.rejectClientInitiatedRenegotiation=true -Djdk.tls.rejectClientInitializedRenego=true \ --cache ispn --cache-stack kubernetes --db mysql --http-relative-path /auth --features-disabled openshift-integration \ --features-disabled step-up-authentication --features-disabled recovery-codes --features-disabled recovery-codes \ --spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true \ --health-enabled true --vault file --auto-build --http-host=${LOCAL_POD_IP:-0.0.0.0}

ncistyang Jun 13, 2022
Author

any update ?

XcrigX · 2022-06-13T16:10:51Z

XcrigX
Jun 13, 2022

Not certain, but just a thought. Could one of those be your logging sidecar?

1 reply

ncistyang Jun 14, 2022
Author

thanks for your reply!
but I think the logging sidecar is not the root cause.
I remove the sidecar container on another test environment, and the two random ports still there.
please see below screenshot

ncistyang · 2022-06-15T05:26:45Z

ncistyang
Jun 15, 2022
Author

up

0 replies

pedroigor · 2022-06-15T14:56:30Z

pedroigor
Jun 15, 2022
Collaborator

The only thing I can think of is JGroups. Did you try running the pod using a local cache to check if those ports are still there?

3 replies

ncistyang Jun 16, 2022
Author

thanks for your help!
you are right , the one is for jgroups
I run a keycloak container using below command:
docker run -d quay.io/keycloak/keycloak:18.0.0 start-dev
then found only one random port there .

pedroigor Jun 20, 2022
Collaborator

When running start-dev you also have the H2 server running. You also have JDBC connections open which also opens more ports.

liuzhenghua Sep 19, 2022

So how to solve this problems?

[keycloak quarkus 18.0.0] what does the "random ports" using for? #12354

Uh oh!

ncistyang Jun 6, 2022

Replies: 4 comments · 6 replies

Uh oh!

abstractj Jun 8, 2022 Maintainer

Uh oh!

Uh oh!

ncistyang Jun 8, 2022 Author

Uh oh!

ncistyang Jun 13, 2022 Author

Uh oh!

XcrigX Jun 13, 2022

Uh oh!

ncistyang Jun 14, 2022 Author

Uh oh!

ncistyang Jun 15, 2022 Author

Uh oh!

pedroigor Jun 15, 2022 Collaborator

Uh oh!

ncistyang Jun 16, 2022 Author

Uh oh!

pedroigor Jun 20, 2022 Collaborator

Uh oh!

liuzhenghua Sep 19, 2022

ncistyang
Jun 6, 2022

Replies: 4 comments 6 replies

abstractj
Jun 8, 2022
Maintainer

ncistyang Jun 8, 2022
Author

ncistyang Jun 13, 2022
Author

XcrigX
Jun 13, 2022

ncistyang Jun 14, 2022
Author

ncistyang
Jun 15, 2022
Author

pedroigor
Jun 15, 2022
Collaborator

ncistyang Jun 16, 2022
Author

pedroigor Jun 20, 2022
Collaborator