Keycloak 20+ docker image hangs on launch with fips enabled on RHEL Centos 7 #16376

zjesse713 · 2023-01-10T21:49:19Z

zjesse713
Jan 10, 2023

During deployment the only logs I see in the terminal is Updating the configuration and installing your custom providers, if any. Please wait.

Dockerfile:

  FROM quay.io/keycloak/keycloak:20.0.2 as builder  
  # Enable health and metrics support
  ENV KC_HEALTH_ENABLED=true
  ENV KC_METRICS_ENABLED=true
  
  #Get SPI and save to providers directory
  RUN curl -sL http://myexample.jar
  
  RUN /opt/keycloak/bin/kc.sh build
  
  
  FROM quay.io/keycloak/keycloak:20.0.2
  COPY --from=builder /opt/keycloak/ /opt/keycloak/
  
  WORKDIR /opt/keycloak
    
  # change these values to point to a running postgres instance
  ENTRYPOINT ["/opt/keycloak/bin/kc.sh","start-dev"]

I do have fips enabled in the environment
Keycloak version: 20.0.1+

Workaround:
Adding environment variable "JAVA_OPTS_APPEND="-Dcom.redhat.fips=false" resolves the issue but seems to be a temporary fix.

gschaden · 2023-01-10T23:32:22Z

gschaden
Jan 10, 2023

Does your image work on you local machine?
Did that work with a previous version?

5 replies

zjesse713 Jan 11, 2023
Author

Yes, Image works on local machine it gets passed checking for spi and deploys.
Previous versions that worked in my openshift cluster 10.0.2 and 14.0.0

gschaden Jan 11, 2023

can you change your startup command
/opt/keycloak/bin/kc.sh --verbose start --log-level=DEBUG

zjesse713 Jan 11, 2023
Author

After updating the startup command with "/opt/keycloak/bin/kc.sh --verbose start --log-level=DEBUG ". The logs in the terminal still only provides "Updating the configuration and installing your custom providers, if any. Please wait." No further logs.

adrian-moisa Jan 29, 2024

I have the same problem on a mac m1 with version quay.io/keycloak/keycloak:22.0.5 start-dev. Last year the same version worked.

Bishop19 Feb 21, 2024

Same as @adrian-moisa

activenode · 2024-05-28T16:55:41Z

activenode
May 28, 2024

Weirdly I have the exact same issue on a DO K8s cluster and weirdly redhat.fips=false helped. How did you come across this ENV change MIGHT help?

0 replies

Navigation Menu

Repository navigation

Keycloak 20+ docker image hangs on launch with fips enabled on RHEL Centos 7 #16376

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

5676 Select a reply

Uh oh!

Keycloak 20+ docker image hangs on launch with fips enabled on RHEL Centos 7 #16376

Uh oh!

Uh oh!

zjesse713 Jan 10, 2023

Replies: 2 comments · 5 replies

Uh oh!

gschaden Jan 10, 2023

Uh oh!

zjesse713 Jan 11, 2023 Author

Uh oh!

gschaden Jan 11, 2023

Uh oh!

Uh oh!

zjesse713 Jan 11, 2023 Author

Uh oh!

adrian-moisa Jan 29, 2024

Uh oh!

Bishop19 Feb 21, 2024

Uh oh!

activenode May 28, 2024

zjesse713
Jan 10, 2023

Replies: 2 comments 5 replies

gschaden
Jan 10, 2023

zjesse713 Jan 11, 2023
Author

zjesse713 Jan 11, 2023
Author

activenode
May 28, 2024