Operator - how to use file based vault in Kubernetes? #16615

RichardSufliarsky · 2023-01-25T13:23:16Z

RichardSufliarsky
Jan 25, 2023

Hi, I am trying to use file based vault with keycloak-operator.v20.0.3 according to this: https://www.keycloak.org/server/vault

Please, can you help me to make it work?

Tried to enable it with vault-dir option (see Keycloak CR below) and getting error when I want to use it in LDAP Bind credentials in the master realm.

When I click on Test authentication, I see in the tcpdump's output that there is ${vault.freeipa-pass} string sent as password.

I see secret mounted in the container:

bash-4.4$ ls /vault
master_freeipa-pass

Keycloak CR:

apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
  name: keycloak-dev
  namespace: dev-keycloak
spec:
  additionalOptions:
  - name: vault-dir
    value: /vault
  unsupported:
    podTemplate:
      spec:
        containers:
        - name: keycloak        
          volumeMounts:
          - name: vault
            mountPath: "/vault"
            readOnly: true
        volumes:
        - name: vault
          secret:
            secretName: vault

Secret:

kind: Secret
apiVersion: v1
metadata:
  name: vault
  namespace: dev-keycloak
data:
  master_freeipa-pass: *****
type: Opaque

Pepo48 · 2023-03-06T16:05:53Z

Pepo48
Mar 6, 2023
Collaborator

Hey @RichardSufliarsky,

I went through the setup of file vault just recently (with the ZIP dist, not with the operator though) and it worked for me. Based on what I see in the issue description I assume you used the default image. Please, try to build your own optimized one with --vault=file build option specified[1] and then specify your own image in your CR[2].

Then the rest of the steps you described should work. Let me know in any case. Thanks!

[1] https://www.keycloak.org/server/containers (see the Building your optimized Keycloak docker image section)
[2] https://www.keycloak.org/operator/customizing-keycloak (see the Providing Custom Keycloak image)

0 replies

Navigation Menu

Repository navigation

Operator - how to use file based vault in Kubernetes? #16615

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Operator - how to use file based vault in Kubernetes? #16615

Uh oh!

RichardSufliarsky Jan 25, 2023

Replies: 1 comment

Uh oh!

Pepo48 Mar 6, 2023 Collaborator

RichardSufliarsky
Jan 25, 2023

Pepo48
Mar 6, 2023
Collaborator