Keycloak with MSSQL Deployment on Kubernetes Cluster

Keycloak

Keycloak is an excessive overall performance Java-primarily based identification totally and gets right of entry to control solution. It shall we builders to upload an authentication layer to their packages with minimal effort. Keycloak is an Open Source IAM solution for applications. Docker Images are available on the quay.io repository.

While looking for an Open Source Identity and Access Management  provider, I was looking for the following:

- OpenID Connect & OAuth 2.0

- Two-factor authentication (Authenticator, E-Mail, SMS, etc.)

- Support Authorization (Attribute-based access control (ABAC), Role-based access control (RBAC), User-based access control (UBAC), Context-based access control (CBAC) Rule-based access control)

- Support Client Libraries

- Modern Tech Stack

- Support Multiple Database (PostgreSQL, MySQL, Microsoft SQL Server, etc.)

- High Performance and Scalable

Dockerize Keycloak with Microsoft SQL (MsSQL) Deployment on Kubernetes Cluster

We can deploy Keycloak on the Kubernetes cluster by creating deployment, service, ingress and secret yaml’s for it.

Keycloak Docker Container Environments

Environment Name Example Value Description

DB_ADDR mssql.data.svc.cluster.local Specify the hostname of the database.

DB_DATABASE keycloak Specify the name of the database to use (optional, default is keycloak).

DB_PORT 1433 Specify the port of the database (optional, default is DB vendor default port)

DB_PASSWORD Password@1 Specify the user’s password to use to authenticate to the database

DB_USER sa Specify users of the database.

DB_SCHEMA

Specify the name of the schema to use for DB that supports schemas.

KEYCLOAK_PASSWORD dbo By default, there is no admin user created so you won’t be able to login to the admin console. To create an admin account you need to use environment variables to pass in an initial username and password.

KEYCLOAK_USER Password@123 By default, there is no admin user created so you won’t be able to login to the admin console. To create an admin account you need to use environment variables to pass in an initial username and password.

JDBC_PARAMS encrypt=false (https://learn.microsoft.com/en-us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver16) JDBC driver connection parameters

If you are getting “Notifications​ KeyCloak Microsoft SQL server connection error “KIX path building failed Exception” set trustServerCertificate=false;encrypt=false values

PROXY_ADDRESS_FORWARDING true/false When running Keycloak behind a proxy, you must enable proxy address forwarding.

1- secret.yaml

apiVersion: v1
stringData:
  KEYCLOAK_ROOT_USER: admin
  KEYCLOAK_ROOT_PASSWORD: Password@1
  KEYCLOAK_DB_USER: sa 
  KEYCLOAK_DB_PASSWORD: Password@1
kind: Secret
metadata:
  name: keycloak-mssql
type: Opaque

2- deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose convert
    kompose.version: 1.26.1 (HEAD)
  creationTimestamp: null
  labels:
    io.kompose.service: keycloak-mssql
  name: keycloak-mssql
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: keycloak-mssql
  strategy: {}
  template:
    metadata:
      annotations:
        kompose.cmd: kompose convert
        kompose.version: 1.26.1 (HEAD)
      creationTimestamp: null
      labels:
        io.kompose.service: keycloak-mssql
    spec:
      containers:
        - env:
            - name: DB_ADDR
              value: mssql.data.svc.cluster.local
            - name: DB_DATABASE
              value: Keycloak
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: KEYCLOAK_DB_PASSWORD
                  name: keycloak-mssql
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  key: KEYCLOAK_DB_USER
                  name: keycloak-mssql
            - name: DB_VENDOR
              value: mssql
            - name: KEYCLOAK_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: KEYCLOAK_ROOT_PASSWORD
                  name: keycloak-mssql
            - name: KEYCLOAK_USER
              valueFrom:
                secretKeyRef:
                  key: KEYCLOAK_ROOT_USER
                  name: keycloak-mssql
            - name: JDBC_PARAMS
              value: trustServerCertificate=false;encrypt=false
            - name: PROXY_ADDRESS_FORWARDING
              value: "true"
          image: quay.io/keycloak/keycloak:19.0.2-legacy
          name: fi-keycloak-mssql
          # args: 
      restartPolicy: Always
status: {}

3- service.yaml

apiVersion: v1
kind: Service
metadata:
  annotations:
    kompose.cmd: kompose convert
    kompose.version: 1.26.1 (HEAD)
  creationTimestamp: null
  labels:
    io.kompose.service: keycloak-mssql
  name: keycloak-mssql
spec:
  ports:
    - name: "8080"
      port: 8080
      targetPort: 8080
  selector:
    io.kompose.service: keycloak-mssql
status:
  loadBalancer: {}

4- ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak-mssql
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - keycloak.mywebsite.com.tr
    secretName:  wildcard-fimple
  rules:
  - host: keycloak.mywebsite.com.tr
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: keycloak-mssql
            port:
              number: 8080

and you are ready for

kubectl apply