Kycloak not using KC_DB_URL_HOST but localhost

Hello,

I have a keycloak on a Kubernetes cluster (EKS). It’s manifest yaml file is set up with :slight_smile: - name: KC_DB
value: “postgres”

  • name: KC_DB_URL_DATABASE
    value: “keycloaxxxdb”
  • name: KC_DB_URL_HOST
    value: “jdbc:postgresql://xxxxx.xxxxx.xxxxx.rds.amazonaws.com”
  • name: KC_DB_URL_PORT
    value: “5432”
  • name: KC_DB_USERNAME
    value: “demoappuser”
  • name: KC_DB_PASSWORD
    value: “demoappuserpassword”

but keycloak tries to login to localhost:5432
org.postgresql.Driver] (agroal-11) Connection error: : org.postgresql.util.PSQLException: Connection to localhost:5432 refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.

How do you start Keycloak? With --optimized flag? Then this won’t work, as KC_DB requires a build step.

The usage of environment variables seems odd.

Reading Configuring the database - Keycloak KC_DB_URL_HOST should template the jdbc connection string, but you’re setting an entirely new jdbc string. Does it log any parsing and fallback errors?

I’d either try to set KC_DB_URL_HOST to xxxxx.xxxxx.xxxxx.rds.amazonaws.com or just use KC_DB_URL as jdbc:postgresql://xxxxx.xxxxx.xxxxx.rds.amazonaws.com/keycloaxxxdb

2 Likes

Ah, yes, @ThoreKr is right, I didn’t see the jdbc:postgresql:// prefix in your KC_DB_URL_HOST param.

Many thanks to all of you.

It was inded a wrong way of setting KC_DB_URL.

I finally used KC_DB_URL instead of KC_DB_URL_HOST withe the correct jdbc format as jdbc:postgresql://xxxxx.xxxxx.xxxxx.rds.amazonaws.com/keycloaxxxdb

I am having the same issue although my settings are looking correct:
in dockerfile:
ENV KC_DB_URL=jdbc:aws-wrapper:postgresql://xxx.example.com:55555/keycloak

in keycloak custom resource:
startOptimized: true
db:
vendor: postgres
url: jdbc:aws-wrapper:postgresql://xxx.example.com:55555/keycloak
poolMinSize: 30
poolInitialSize: 30
poolMaxSize: 30

The error message:
WARN [io.agroal.pool] (agroal-11) Datasource ‘’: Connection to localhost:5432 refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections.

What happens if I define the database URL in dockerfile as env variable AND in keycloak custom resource?
I also tried with start --optimized but to no avail.
I am trying to install keycloak 24.0.4 with operator.

I was able run start the pods by setting startOptimized to false.
But this wrong behaviour because I am building my image and then start it.
When running docker build I see this message: “Quarkus augmentation completed in 21049ms”
I am following the steps here: Deploy Keycloak for HA with the Keycloak Operator - Keycloak
I have an augmented image but can not start it optimized.
Did I miss something?

Are you setting the vendor (KC_DB env variable) as well in the dockerfile?

@ThoreKr Yes, twice!

This my complete dockerfile:

FROM quay .io/keycloak/keycloak:24.0.4 as builder
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange,admin-fine-grained-authz
ENV KC_DB=postgres

WORKDIR /opt/keycloak
RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname “CN=server” -alias server -ext “SAN:c=DNS:localhost,IP:127.0.0.1” -keystore conf/server.keystore

ADD --chmod=0666 aws-advanced-jdbc-wrapper-2.3.6.jar /opt/keycloak/providers/aws-advanced-jdbc-wrapper.jar
ADD --chmod=0666 keycloak-spi-rolepolicy-24.0.4.jar /opt/keycloak/providers/keycloak-spi-rolepolicy-24.0.4.jar

RUN /opt/keycloak/bin/kc.sh build

FROM quay .io/keycloak/keycloak:24.0.4
COPY --from=builder /opt/keycloak/ /opt/keycloak/

ENV KC_DB=postgres
ENV KC_DB_DRIVER=software.amazon.jdbc.Driver
ENV KC_TRANSACTION_XA_ENABLED=false
ENV KC_DB_URL=jdbc:aws-wrapper:postgresql://xxx.example.com:55555/keycloak
ENV KEYCLOAK_ADMIN=admin
ENV KEYCLOAK_ADMIN_PASSWORD=admin
ENV KC_DB_USERNAME=xxxxx
ENV KC_DB_PASSWORD=yyyyyyy
ENV KC_HOSTNAME=keycloak.example.com
ENV KC_HTTP_ENABLED=true
ENV KC_HOSTNAME_STRICT=true
ENV KC_HOSTNAME_STRICT_HTTPS=true
ENTRYPOINT [“/opt/keycloak/bin/kc.sh”]

That indeed looks fine. Only thing i can spot is that KC_TRANSACTION_XA_ENABLED is a build time argument, so it should be in the build stage.

I’d really love to see more logging from kc when the database configuration detection goes wrong.

Theses are the error messages when running docker build:

#10 [builder 6/6] RUN /opt/keycloak/bin/kc.sh build
#10 sha256:e0bb7b6bc247007d47f56ef372c26c36ab148efd332c5ab8c5ea7b
#10 2.173 Updating the configuration and installing your custom providers, if any. Please wait.
#10 11.75 2024-05-27 07:33:26,469 WARN [org.key.services] (build-49) KC-SERVICES0047: role (com.keycloak.policy.provider.RolePolicyProviderFactory) is implementing the internal SPI policy. This SPI is internal and may change without notice
#10 15.04 2024-05-27 07:33:31,417 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.springframework.core.io.DefaultResourceLoader: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.04 2024-05-27 07:33:31,419 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.springframework.core.io.ResourceLoader: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.04 2024-05-27 07:33:31,426 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.apache.tools.ant.Task: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.11 2024-05-27 07:33:31,489 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.springframework.core.io.Resource: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.15 2024-05-27 07:33:31,530 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.apache.activemq.artemis.core.journal.RecordInfo: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.15 2024-05-27 07:33:31,532 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index org.apache.activemq.artemis.core.journal.Journal: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.15 2024-05-27 07:33:31,534 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.mashona.logwriting.ArrayStore: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.18 2024-05-27 07:33:31,561 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index jakarta.jms.XAConnection: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.18 2024-05-27 07:33:31,562 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index jakarta.jms.XASession: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.18 2024-05-27 07:33:31,563 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index jakarta.jms.XAConnectionFactory: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.28 2024-05-27 07:33:31,658 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index jakarta.jms.Connection: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.49 2024-05-27 07:33:31,871 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.api.metrics.LongCounter: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.49 2024-05-27 07:33:31,873 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.api.metrics.Meter: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.49 2024-05-27 07:33:31,874 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.50 2024-05-27 07:33:31,878 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index com.zaxxer.hikari.HikariDataSource: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.51 2024-05-27 07:33:31,893 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.api.trace.Tracer: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.52 2024-05-27 07:33:31,899 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.api.metrics.ObservableLongGauge: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.52 2024-05-27 07:33:31,904 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.context.Scope: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.52 2024-05-27 07:33:31,906 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index io.opentelemetry.api.trace.Span: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.53 2024-05-27 07:33:31,907 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index com.amazonaws.xray.entities.Entity: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.54 2024-05-27 07:33:31,921 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index software.amazon.awssdk.regions.Region: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a
#10 15.54 2024-05-27 07:33:31,923 WARN [io.qua.dep.ind.IndexWrapper] (build-44) Failed to index software.amazon.awssdk.services.secretsmanager.SecretsManagerClient: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@b5cc23a

And these are the errors when starting the pod:

2024-05-27 07:39:33,323 WARN [org.keycloak.quarkus.runtime.cli.Picocli] (main) The following build time non-cli options were found, but will be ignored during run time: kc.cache, kc.cache-stack, kc.db-driver, kc.db, kc.transaction-xa-enabled, kc.features, kc.health-enabled

2024-05-27 07:39:33,324 WARN [org.keycloak.quarkus.runtime.cli.Picocli] (main) The following used options or option values are DEPRECATED and will be removed in a future release:
- proxy: Use proxy-headers.
Consult the Release Notes for details.
2024-05-27 07:39:34,642 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: , Hostname: keycloak.example.com, Strict HTTPS: true, Path: , Strict BackChannel: false, Admin URL: , Admin: , Port: -1, Proxied: true
2024-05-27 07:39:35,358 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller ‘org.infinispan.jboss.marshalling.core.JBossUserMarshaller’
2024-05-27 07:39:35,954 INFO [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel ISPN with stack kubernetes
2024-05-27 07:39:35,964 INFO [org.jgroups.JChannel] (keycloak-cache-init) local_addr: 1b8ef871-c1f6-4ed8-ab9f-470082b45d0f, name: keycloak-0-2312
2024-05-27 07:39:36,004 INFO [org.jgroups.protocols.FD_SOCK2] (keycloak-cache-init) server listening on *.57800
2024-05-27 07:39:38,015 WARN [io.agroal.pool] (JPA Startup Thread) Datasource ‘’: Driver does not support the provided URL: jdbc:aws-wrapper:postgresql://xxx.example.com:55555/keycloak
2024-05-27 07:39:38,016 INFO [org.jgroups.protocols.pbcast.GMS] (keycloak-cache-init) keycloakha-0-2312: no members discovered after 2007 ms: creating cluster as coordinator
2024-05-27 07:39:38,049 WARN [io.agroal.pool] (agroal-11) Datasource ‘’: Driver does not support the provided URL: jdbc:aws-wrapper:xxx.example.com:55555/keycloak
2024-05-27 07:39:38,050 WARN [io.agroal.pool] (agroal-11) Datasource ‘’: Driver does not support the provided URL: jdbc:aws-wrapper:postgresql://xxx.example.com:55555/keycloak

At the beginning there is message:
The following build time non-cli options were found, but will be ignored during run time: kc.cache, kc.cache-stack, kc.db-driver, kc.db
I also tried to pass db-driver as cli option but to no avail.

I just moved ENV KC_DB_DRIVER=software.amazon.jdbc.Driver up to the build. Now it works without any error message.