<p>Following the sample at <a href="https://github.com/thomasdarimont/helm-charts/blob/master/charts/keycloakx/examples/postgresql" rel="nofollow noreferrer">https://github.com/thomasdarimont/helm-charts/blob/master/charts/keycloakx/examples/postgresql</a>, I'm trying to install Keycloak and Postrgresql with helm charts on OVH managed Kubernetes but the database initialisation fails.</p>
<p>Here are the logs on Postgresql pod:</p>
<pre><code>2023-04-14 07:22:21.638 GMT [1] LOG:  database system is ready to accept connections
2023-04-14 07:23:04.073 GMT [195] ERROR:  relation &quot;migration_model&quot; does not exist at character 25
2023-04-14 07:23:04.073 GMT [195] STATEMENT:  SELECT ID, VERSION FROM MIGRATION_MODEL ORDER BY UPDATE_TIME DESC
2023-04-14 07:23:05.364 GMT [195] ERROR:  relation &quot;public.databasechangelog&quot; does not exist at character 22
2023-04-14 07:23:05.364 GMT [195] STATEMENT:  SELECT COUNT(*) FROM public.databasechangelog
2023-04-14 07:23:06.423 GMT [210] ERROR:  relation &quot;public.databasechangeloglock&quot; does not exist at character 22
2023-04-14 07:23:06.423 GMT [210] STATEMENT:  SELECT COUNT(*) FROM public.databasechangeloglock
2023-04-14 07:23:06.831 GMT [195] ERROR:  relation &quot;public.databasechangelog&quot; does not exist at character 22
2023-04-14 07:23:06.831 GMT [195] STATEMENT:  SELECT COUNT(*) FROM public.databasechangelog
</code></pre>
<p>I've read somewhere that it could be related to a PVC issue, so I tried to force it, but no more luck.</p>
<p>Here is the script I run:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl create namespace keycloak
kubectl apply -f keycloak-postgresql-pvc.yml
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo update
helm install keycloak-db bitnami/postgresql -n keycloak --values ./keycloak-postgresql-properties.yaml
helm install keycloak codecentric/keycloakx -n keycloak -f keycloak-install-properties.yml
kubectl apply -f ingress-nginx.yaml
</code></pre>
<p>and here are the files referenced:</p>
<ul>
<li><code>keycloak-postgresql-pvc.yml</code></li>
</ul>
<pre class="lang-yaml prettyprint-override"><code>kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postgresql-keycloak
  namespace: keycloak
  labels:
    app: postgresql
spec:
  storageClassName: csi-cinder-classic
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
</code></pre>
<ul>
<li><code>keycloak-postgresql-properties.yaml</code>:</li>
</ul>
<pre class="lang-yaml prettyprint-override"><code># See https://github.com/bitnami/charts/tree/master/bitnami/postgresql

global:
  postgresql:
    auth:
      username: keycloak
      password: change-me
      database: keycloak
primary:
  persistence:
    existingClaim: postgresql-keycloak
</code></pre>
<ul>
<li><code>keycloak-install-properties.yml</code></li>
</ul>
<pre class="lang-yaml prettyprint-override"><code># See https://www.keycloak.org/server/configuration
# See https://www.keycloak.org/server/all-config
image:
  tag: 21.0.2

command:
  - &quot;/opt/keycloak/bin/kc.sh&quot;
  - &quot;--verbose&quot;
  - &quot;start&quot;
  - &quot;--auto-build&quot;
  - &quot;--http-enabled=true&quot;
  - &quot;--http-port=8080&quot;
  - &quot;--hostname-strict=false&quot;
  - &quot;--hostname-strict-https=false&quot;
  - &quot;--spi-events-listener-jboss-logging-success-level=info&quot;
  - &quot;--spi-events-listener-jboss-logging-error-level=warn&quot;

extraEnv: |
  - name: KEYCLOAK_ADMIN
    valueFrom:
      secretKeyRef:
        name: {{ include &quot;keycloak.fullname&quot; . }}-admin-creds
        key: user
  - name: KEYCLOAK_ADMIN_PASSWORD
    valueFrom:
      secretKeyRef:
        name: {{ include &quot;keycloak.fullname&quot; . }}-admin-creds
        key: password
  - name: JAVA_OPTS_APPEND
    value: &gt;-
      -XX:+UseContainerSupport
      -XX:MaxRAMPercentage=50.0
      -Djava.awt.headless=true
      -Djgroups.dns.query={{ include &quot;keycloak.fullname&quot; . }}-headless
dbchecker:
  enabled: true

database:
  vendor: postgres
  hostname: keycloak-db-postgresql
  port: 5432
  username: keycloak
  password: change-me
  database: keycloak

secrets:
  admin-creds:
    annotations:
      my-test-annotation: Test secret for {{ include &quot;keycloak.fullname&quot; . }}
    stringData:
      user: admin
      password: change-me

replicas: 1
restartPolicy: &quot;Always&quot;
</code></pre>
<p>Any clue what I'm doing wrong?</p>
<p>Anyone managed to install a recent Keycloak instance (note I'm using <code>codecentric/keycloakx</code> and not <code>codecentric/keycloak</code>) on OVH managed Kubernetes (with a DB on a PV)?</p>

ch4mp
<p>So, the SQL errors during init are just some noise and the server was actually correctly installed. My issue was in the ingress rules to access it.</p>
<h4>How did I figure that out?</h4>
<p>I temporarily exposed the DB and explored it with my favorite DB admin tool (I already have a local Postgres bound to 5432, so using 5431):</p>
<pre class="lang-bash prettyprint-override"><code>kubectl get all -n keycloak
kubectl port-forward --namespace keycloak service/keycloak-db-postgresql 5431:5432
</code></pre>
<p>The DB at <code>jdbc:postgresql://localhost:5431/keycloak</code> was there and correctly initialized.</p>
<p>I then did the same for the Keycloak server:</p>
<pre class="lang-bash prettyprint-override"><code>kubectl port-forward --namespace keycloak service/keycloak-keycloakx-http 8080:80
</code></pre>
<p>The server was up and running and accessible from: <code>http://localhost:8080</code></p>
<h4>Ingress for <code>codecentric/keycloakx</code></h4>
<p>When switching from <code>codecentric/keycloak</code> to <code>codecentric/keycloakx</code>, be aware that ports change from <code>8080</code> to <code>80</code> and <code>8443</code> to <code>443</code>. Also, the service name changes from <code>keycloak-http</code> to <code>keycloak-keycloakx-http</code>. So if you picked a sample ingress rule for the older chart, you have to adapt it. Here is what I used:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    # This annotation indicates the issuer to use
    cert-manager.io/cluster-issuer: letsencrypt-production
    acme.cert-manager.io/http01-edit-in-place: &quot;true&quot;
  name: keycloak
  namespace: keycloak
spec:
  rules:
  - host: change-me.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: keycloak-keycloakx-http
            port:
              number: 80
  tls:
    - hosts:
        - change-me.com
      secretName: keycloak-tls
</code></pre>
