<p>I checked this <a href="https://stackoverflow.com/questions/66557539/how-to-create-keycloak-with-operator-and-external-database">How to use</a> for Keycloak operator custom resource using external database connection. I am using CloudSQL from Google platform as the external database source.</p>
<p>My configurations are</p>
<ul>
<li>keycloak-idm</li>
</ul>
<pre><code>apiVersion: keycloak.org/v1alpha1
kind: Keycloak
metadata:
  name: kiwigrid-keycloak-idm
spec:
  instances: 3
  externalAccess:
    enabled: false
  externalDatabase:
    enabled: true
</code></pre>
<ul>
<li>external db storage secret</li>
</ul>
<pre><code>apiVersion: v1
kind: Secret
metadata:
    name: keycloak-db-secret
    namespace: kiwios-application
type: Opaque
stringData:
    POSTGRES_DATABASE: keycloak-storage
    POSTGRES_EXTERNAL_ADDRESS: pgsqlproxy.infra
    POSTGRES_EXTERNAL_PORT: &quot;5432&quot;
    POSTGRES_HOST: keycloak-postgresql
    POSTGRES_USERNAME: keycloak-user
    POSTGRES_PASSWORD: S1ly3AValJYBNR-fsptLYdT74
    POSTGRES_SUPERUSER: &quot;true&quot;

</code></pre>
<ul>
<li>storage database</li>
</ul>
<pre><code>apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLDatabase
metadata:
  name: keycloak-storage
  namespace: kiwios-application
  annotations:
    cnrm.cloud.google.com/deletion-policy: &quot;abandon&quot;
spec:
  charset: UTF8
  collation: en_US.UTF8
  instanceRef:
    name: keycloak-storage-instance-pg
    namespace: infra
</code></pre>
<ul>
<li>storage users</li>
</ul>
<pre><code>apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLUser
metadata:
  name: keycloak-user
  namespace: kiwios-application
  annotations:
    cnrm.cloud.google.com/deletion-policy: &quot;abandon&quot;
spec:
  instanceRef:
    name: keycloak-storage-instance-pg
    namespace: infra
  password:
    valueFrom:
      secretKeyRef:
        name: keycloak-db-secret
        key: POSTGRES_PASSWORD
</code></pre>
<p>And the error shown in Kubernetes console
<a href="https://i.stack.imgur.com/sJegJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sJegJ.png" alt="error" /></a></p>
<p>It is not working. Anyone please help me to figure out what I am doing wrong.</p>
<p><strong>Update:</strong> I deep dived with k9s console. As per <code>keycloak-operator</code> functionality it creates a external name for the database connection.
which is here <code>keycloak-postgresql</code></p>
<p>check image below
<a href="https://i.stack.imgur.com/qXSe6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qXSe6.png" alt="keycloak-postgresql works" /></a></p>
<p>There is no error showing in <code>keycloak-operator</code> console. Only the <code>keycloak-idm</code> is not able to make a connection using this <em>external name</em>. It shows the below error.
<a href="https://i.stack.imgur.com/sJegJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sJegJ.png" alt="error" /></a></p>

<p>This is what i am using for keycloak setup, also if you have read the question he has mention secret issue issue in update section</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  selector:
    app: keycloak
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: default
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:10.0.0
        env:
        - name: KEYCLOAK_USER
          value: &quot;admin&quot;
        - name: KEYCLOAK_PASSWORD
          value: &quot;admin&quot;
        - name: PROXY_ADDRESS_FORWARDING
          value: &quot;true&quot;
        - name: DB_VENDOR
          value: POSTGRES
        - name: DB_ADDR
          value: postgres
        - name: DB_DATABASE
          value: keycloak
        - name: DB_USER
          value: root
        - name: DB_PASSWORD
          value: password
        - name : KEYCLOAK_HTTP_PORT
          value : &quot;80&quot;
        - name: KEYCLOAK_HTTPS_PORT
          value: &quot;443&quot;
        - name : KEYCLOAK_HOSTNAME
          value : keycloak.harshmanvar.tk #replace with ingress URL
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        readinessProbe:
          httpGet:
            path: /auth/realms/master
            port: 8080
</code></pre>
<p>You can try changing the ENV variables into the secret you are using.</p>
<p>Example files : <a href="https://github.com/harsh4870/Keycloack-postgres-kubernetes-deployment" rel="nofollow noreferrer">https://github.com/harsh4870/Keycloack-postgres-kubernetes-deployment</a></p>
<p>Environment variables that Keycloak support : <a href="https://github.com/keycloak/keycloak-containers/blob/master/server/README.md#environment-variables" rel="nofollow noreferrer">https://github.com/keycloak/keycloak-containers/blob/master/server/README.md#environment-variables</a></p>
