Keycloakx MySQL (GCP Cloud SQL) with require_ssl = true - Unable to connect

Question

Keycloakx MySQL (GCP Cloud SQL) with require_ssl = true - Unable to connect

ddezoysa opened this issue a year ago · comments

Hi,

Keycloak version: v20.0.3
Database MySQL: v8.0.26 in Cloud SQL

When the require_ssl = false in Cloud SQL, Keycloak pods will come up without any issues. So there are not firewall connectivity or credentials issues.

database:
  vendor: mysql
  hostname: x.x.x.x
  port: "3306"
  database: xxxx
  username: myusername
  password: xxxx

When the require_ssl = true is set in Cloud SQL, Pod goes into CrashBackLoop as the SSL client certificates are not passed to the Keycloak configurations.

Defaulted container "keycloak" out of: keycloak, dbchecker (init)
Appending additional Java properties to JAVA_OPTS: -XX:+UseContainerSupport -XX:MaxRAMPercentage=50.0 -Djava.awt.headless=true -Djgroups.dns.query=keycloak-headless
Changes detected in configuration. Updating the server image.
Updating the configuration and installing your custom providers, if any. Please wait.
2023-04-13 10:47:56,200 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 13341ms
Server configuration updated and persisted. Run the following command to review the configuration:

        kc.sh show-config

Next time you run the server, just run:

        kc.sh start --optimized --http-enabled=true --http-port=8080 --hostname-strict=false --hostname-strict-https=false --spi-events-listener-jboss-logging-success-level=info --spi-events-listener-jboss-logging-error-level=warn

WARNING: The '--auto-build' option for 'start' command is DEPRECATED and no longer needed. When executing the 'start' command, a new server image is automatically built based on the configuration. If you want to disable this behavior and achieve an optimal startup time, use the '--optimized' option instead.
2023-04-13 10:47:59,834 INFO  [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: <unset>, Hostname: <request>, Strict HTTPS: false, Path: <request>, Strict BackChannel: false, Admin URL: <unset>, Admin: <request>, Port: -1, Proxied: true
2023-04-13 10:48:01,876 WARN  [io.quarkus.agroal.runtime.DataSources] (main) Datasource <default> enables XA but transaction recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly
2023-04-13 10:48:02,630 WARN  [io.agroal.pool] (agroal-11) Datasource '<default>': Access denied for user 'myusername'@'x.x.x.x' (using password: YES)
2023-04-13 10:48:02,632 WARN  [org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator] (JPA Startup Thread: keycloak-default) HHH000342: Could not obtain connection to query metadata: java.sql.SQLException: Access denied for user 'myusername'@'x.x.x.x' (using password: YES)
        at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:129)
        at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:122)
        at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:828)
        at com.mysql.cj.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:448)
        at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:241)
        at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:198)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:416)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:128)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:113)
        at com.mysql.cj.jdbc.MysqlXADataSource.getXAConnection(MysqlXADataSource.java:52)
        at io.agroal.pool.ConnectionFactory.createConnection(ConnectionFactory.java:232)
        at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:535)
        at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:516)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at io.agroal.pool.util.PriorityScheduledExecutor.beforeExecute(PriorityScheduledExecutor.java:75)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1126)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)

2023-04-13 10:48:03,366 WARN  [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled
2023-04-13 10:48:03,378 WARN  [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal
2023-04-13 10:48:03,421 INFO  [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller'
2023-04-13 10:48:03,823 INFO  [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000128: Infinispan version: Infinispan 'Triskaidekaphobia' 13.0.10.Final
2023-04-13 10:48:03,951 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel `ISPN`
2023-04-13 10:48:06,121 INFO  [org.jgroups.protocols.pbcast.GMS] (keycloak-cache-init) keycloak-0-60954: no members discovered after 2006 ms: creating cluster as coordinator
2023-04-13 10:48:06,132 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000094: Received new cluster view for channel ISPN: [keycloak-0-60954|0] (1) [keycloak-0-60954]
2023-04-13 10:48:06,137 INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000079: Channel `ISPN` local address is `keycloak-0-60954`, physical addresses are `[x.x.x.x:7800]`
2023-04-13 10:48:06,814 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: keycloak-0-60954, Site name: null
2023-04-13 10:48:06,820 INFO  [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener
2023-04-13 10:48:06,854 WARN  [io.agroal.pool] (agroal-11) Datasource '<default>': Access denied for user 'myusername'@'x.x.x.x' (using password: YES)
2023-04-13 10:48:06,898 INFO  [org.infinispan.CLUSTER] (main) ISPN000080: Disconnecting JGroups channel `ISPN`
2023-04-13 10:48:06,989 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (production) mode
2023-04-13 10:48:06,989 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) Error details:: java.lang.RuntimeException: Failed to obtain JDBC connection
        at org.keycloak.quarkus.runtime.storage.database.jpa.AbstractJpaConnectionProviderFactory.getConnection(AbstractJpaConnectionProviderFactory.java:53)
        at org.keycloak.quarkus.runtime.storage.legacy.database.LegacyJpaConnectionProviderFactory.postInit(LegacyJpaConnectionProviderFactory.java:115)
        at org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSessionFactory.init(QuarkusKeycloakSessionFactory.java:104)
        at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication.startup(QuarkusKeycloakApplication.java:42)
        at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver.onStartupEvent(QuarkusLifecycleObserver.java:37)
        at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver_Observer_onStartupEvent_b0e82415b143738dc1f986a5fa4668e83d0a5dea.notify(Unknown Source)
        at io.quarkus.arc.impl.EventImpl$Notifier.notifyObservers(EventImpl.java:326)
        at io.quarkus.arc.impl.EventImpl$Notifier.notify(EventImpl.java:308)
        at io.quarkus.arc.impl.EventImpl.fire(EventImpl.java:76)
        at io.quarkus.arc.runtime.ArcRecorder.fireLifecycleEvent(ArcRecorder.java:131)
        at io.quarkus.arc.runtime.ArcRecorder.handleLifecycleEvents(ArcRecorder.java:100)
        at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy_0(Unknown Source)
        at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy(Unknown Source)
        at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
        at io.quarkus.runtime.Application.start(Application.java:101)
        at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:110)
        at io.quarkus.runtime.Quarkus.run(Quarkus.java:70)
        at org.keycloak.quarkus.runtime.KeycloakMain.start(KeycloakMain.java:103)
        at org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.run(AbstractStartCommand.java:37)
        at picocli.CommandLine.executeUserObject(CommandLine.java:1939)
        at picocli.CommandLine.access$1300(CommandLine.java:145)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2358)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2352)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2314)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2179)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2316)
        at picocli.CommandLine.execute(CommandLine.java:2078)
        at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:93)
        at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:89)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:61)
        at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:32)
Caused by: java.sql.SQLException: Access denied for user 'myusername'@'x.x.x.x' (using password: YES)
        at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:129)
        at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:122)
        at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:828)
        at com.mysql.cj.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:448)
        at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:241)
        at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:198)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:416)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:128)
        at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:113)
        at com.mysql.cj.jdbc.MysqlXADataSource.getXAConnection(MysqlXADataSource.java:52)
        at io.agroal.pool.ConnectionFactory.createConnection(ConnectionFactory.java:232)
        at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:535)
        at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:516)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at io.agroal.pool.util.PriorityScheduledExecutor.beforeExecute(PriorityScheduledExecutor.java:75)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1126)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)

SSL client certificate, key and server certificates are mounted to the keycloak pod as files using extraVolumes, extraVolumeMounts.

MountPath: /etc/ssl/certs/mysql
Files: tls.crt, tls.key, ca.crt

Please help on what variables to be set to provide ssl-cert, ssl-key and ssl-ca to the Keycloak server?

ismail yenigul · Answer 1 · Fri Apr 14 2023 04:52:03 GMT+0800 (China Standard Time)

#182 (comment)
This might help you

github-actions · Answer 2 · Tue Jun 13 2023 20:04:16 GMT+0800 (China Standard Time)

This issue has been marked as stale because it has been open for 30 days with no activity. It will be automatically closed in 10 days if no further activity occurs.