Kubernetes quickstart: replicas:2 creates non-clustering pods (misleading) #45098

maxt1907 · 2025-12-30T11:36:01Z

maxt1907
Dec 30, 2025

Description:
Official kubernetes/keycloak.yaml deploys 2 replicas that never form a cluster (https://www.keycloak.org/getting-started/getting-started-kube)

Issue:

YAML: replicas: 2
Docs: "two replicas to allow for rolling updates"
Result: 2x Singletons, Cluster Health DOWN, NoRouteToHostException spam

keycloak-0-12955: failed sending message to 10.42.0.32:7800: java.net.NoRouteToHostException: No route to host

I tried specific network policies which could account for the problem. Also I tried a modified version of the keycloak-discovery service to point directly to the affected ports for multi replica use.

I think it maybe a configuration issue from my side but I tried troubleshooting it without success.

Expected: Working 2-node cluster oder replicas: 1 im YAML
Actual: Misleading "cluster-ready" appearance

Besides that, I configured my own Keycloak statefulset which does not work correctly either.

apiVersion: v1
kind: Service
metadata:
name: keycloak
labels:
app: keycloak
spec:
ports:
- protocol: TCP
port: 8443
targetPort: https
name: https
selector:
app: keycloak
type: ClusterIP

apiVersion: v1
kind: Service
metadata:
labels:
app: keycloak
name: keycloak-discovery
spec:
selector:
app: keycloak
clusterIP: None
type: ClusterIP

apiVersion: apps/v1
kind: StatefulSet
metadata:
name: keycloak
labels:
app: keycloak
spec:
serviceName: keycloak-discovery
replicas: 2
selector:
matchLabels:
app: keycloak
template:
metadata:
labels:
app: keycloak
spec:
containers:
- name: keycloak
image: quay.io/keycloak/keycloak:26.4.7
volumeMounts:
- name: keycloak-tls
mountPath: /etc/keycloak/tls
readOnly: true
args: ["start"]
env:
- name: KC_BOOTSTRAP_ADMIN_USERNAME
valueFrom:
secretKeyRef:
name: keycloak-admin-account
key: admin-username
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: keycloak-admin-account
key: admin-password
- name: 'KC_PROXY_HEADERS'
value: 'xforwarded'
- name: 'KC_HTTP_ENABLED'
value: "true"
- name: 'KC_HOSTNAME'
value: 'https://example.com'
- name: 'KC_HOSTNAME_ADMIN'
value: 'https://example.com'
- name: 'KC_HTTPS_PORT'
value: '8443'
- name: 'KC_HTTPS_CERTIFICATE_FILE'
value: '/etc/keycloak/tls/tls.crt'
- name: 'KC_HTTPS_CERTIFICATE_KEY_FILE'
value: '/etc/keycloak/tls/tls.key'
- name: 'KC_HOSTNAME_STRICT'
value: 'false'
- name: 'KC_HEALTH_ENABLED'
value: 'true'
- name: 'KC_CACHE'
value: 'ispn'
- name: 'KC_CACHE_STACK'
value: 'kubernetes'
- name: 'POD_IP'
valueFrom:
fieldRef:
fieldPath: status.podIP
- name: KC_CACHE_EMBEDDED_NETWORK_BIND_ADDRESS
value: '$(POD_IP)'
- name: 'KC_DB_URL'
value: 'jdbc:postgresql://keycloak-db.homelab.svc.cluster.local:5432/keycloak'
- name: 'KC_DB'
value: 'postgres'
- name: 'KC_HTTP_MANAGEMENT_SCHEME'
value: 'http'
- name: 'KC_DB_PASSWORD'
valueFrom:
secretKeyRef:
name: keycloak-postgres-credentials
key: postgres-password
- name: 'KC_DB_USERNAME'
valueFrom:
secretKeyRef:
name: keycloak-postgres-credentials
key: postgres-user
ports:
- name: http
containerPort: 8080
- name: https
containerPort: 8443
- name: jgroups
containerPort: 7800
- name: jgroups-fd
containerPort: 57800
startupProbe:
httpGet:
path: /health/started
port: 9000
initialDelaySeconds: 80
periodSeconds: 10
failureThreshold: 600
readinessProbe:
httpGet:
path: /health/ready
port: 9000
initialDelaySeconds: 80
periodSeconds: 10
failureThreshold: 600
livenessProbe:
httpGet:
path: /health/live
port: 9000
initialDelaySeconds: 80
periodSeconds: 10
failureThreshold: 600
resources:
limits:
cpu: 2000m
memory: 2000Mi
requests:
cpu: 500m
memory: 1700Mi
volumes:
- name: keycloak-tls
secret:
secretName: keycloak-tls

I appreciate your help.

Answered by shawkins

Dec 30, 2025

I could not reproduce what you are seeing on minikube. Can you provide exactly what flavor and version of Kubernetes you are running on?

In your statefulset note that the kubernetes cache stack is deprecated.

View full answer

shawkins · 2025-12-30T16:56:54Z

shawkins
Dec 30, 2025
Collaborator

I could not reproduce what you are seeing on minikube. Can you provide exactly what flavor and version of Kubernetes you are running on?

In your statefulset note that the kubernetes cache stack is deprecated.

0 replies

maxt1907 · 2025-12-31T14:40:11Z

Navigation Menu

Repository navigation

Kubernetes quickstart: replicas:2 creates non-clustering pods (misleading) #45098

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

maxt1907
Dec 31, 2025
Author

Select a reply

Uh oh!

Kubernetes quickstart: replicas:2 creates non-clustering pods (misleading) #45098

Uh oh!

Uh oh!

maxt1907 Dec 30, 2025

Replies: 2 comments

Uh oh!

shawkins Dec 30, 2025 Collaborator

Uh oh!

Uh oh!

maxt1907 Dec 31, 2025 Author

maxt1907
Dec 30, 2025

shawkins
Dec 30, 2025
Collaborator

maxt1907
Dec 31, 2025
Author