高可用 Keycloak，K8s

使用 K8S 部署 Keycloak，使用 Mysql 做為外部存儲工具。以實作 Keycloak 在生産環境中高可用。

目錄

• • Keycloak K8s 配置檔案

Keycloak 官方有一個 Keycloak on Kubernetes 教程，可以看出官方教程隻是簡單的說了如何通過 K8s 部署服務。

修改官方提供的 yaml 檔案

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  selector:
    app: keycloak
  type: LoadBalancer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: default
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:13.0.0
        env:
        - name: KEYCLOAK_USER
          value: "admin"
        - name: KEYCLOAK_PASSWORD
          value: "admin"
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        readinessProbe:
          httpGet:
            path: /auth/realms/master
            port: 8080
           

1. 修改鏡像位址，原因是該鏡像有較為清晰的文檔

   image: jboss/keycloak:13.0.0
              

2. 配置 Mysql 變量，在建立 keycloak Mysql 資料庫時，注意，建立的資料庫編碼應為

   utf8

   ，

   create schema keycloak character set utf8 collate utf8_unicode_ci;

   - name: DB_VENDOR
      value: mysql
    - name: DB_ADDR
      value: 10.0.5.213:3306
    - name: DB_DATABASE
      value: keycloak
    - name: DB_USER
      value: root
    - name: DB_PASSWORD
      value: 12345678
              

   改造後的 yaml 檔案為：

   apiVersion: v1
    kind: Service
    metadata:
    name: keycloak
    labels:
        app: keycloak
    spec:
    ports:
    - name: http
        port: 8080
        targetPort: 8080
    selector:
        app: keycloak
    type: LoadBalancer
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: keycloak
    labels:
        app: keycloak
    spec:
    replicas: 2
    selector:
        matchLabels:
        app: keycloak
    template:
        metadata:
        labels:
            app: keycloak
        spec:
        containers:
        - name: keycloak
            image: jboss/keycloak:13.0.0
            env:
            - name: KEYCLOAK_USER
            value: "admin"
            - name: KEYCLOAK_PASSWORD
            value: "admin"
            - name: PROXY_ADDRESS_FORWARDING
            value: "true"
            - name: DB_VENDOR
            value: mysql
            - name: DB_ADDR
            value: "127.0.0.1"
            - name: DB_PORT
            value: "3306"
            - name: DB_DATABASE
            value: keycloak
            - name: DB_USER
            value: "root"
            - name: DB_PASSWORD
            value: "123456"
            ports:
            - name: http
            containerPort: 8080
            - name: https
            containerPort: 8443
            readinessProbe:
            httpGet:
                path: /auth/realms/master
                port: 8080
              

3. 把 yaml 檔案複制到伺服器中，然後建立

   kc

   空間，指令如下

   kubectl create ns kc

   ，執行指令

   kubectl apply -f keycloak.yaml -n kc

   以啟動服務
4. 通路 Keycloak 服務，

   127.0.0.1:8080

   

   點選

   Administration Console

   ,使用賬号

   admin

   、密碼

   admin

   登入