From 0873691913cfb02b855241bd9c1a9bfcddb5b7c6 Mon Sep 17 00:00:00 2001 From: mattia-eleuteri Date: Fri, 6 Mar 2026 10:19:52 +0100 Subject: [PATCH] fix(keycloak): use management port health endpoints for probes Keycloak 26.x exposes dedicated health endpoints on the management port (9000) via /health/live and /health/ready. The previous probes used GET / on port 8080 which redirects to the configured KC_HOSTNAME (HTTPS), causing kubelet to fail the probe with "Probe terminated redirects" and eventually kill the pod in a crashloop. Changes: - Add KC_HEALTH_ENABLED=true to activate health endpoints - Expose management port 9000 in container ports - Switch liveness probe to /health/live on port 9000 - Switch readiness probe to /health/ready on port 9000 - Increase failure thresholds for more tolerance during startup Co-Authored-By: Claude Opus 4.6 Signed-off-by: mattia-eleuteri --- packages/system/keycloak/templates/sts.yaml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/packages/system/keycloak/templates/sts.yaml b/packages/system/keycloak/templates/sts.yaml index 1cdbec62..60cdb9d2 100644 --- a/packages/system/keycloak/templates/sts.yaml +++ b/packages/system/keycloak/templates/sts.yaml @@ -76,6 +76,8 @@ spec: {{- end }} - name: KC_METRICS_ENABLED value: "true" + - name: KC_HEALTH_ENABLED + value: "true" - name: KC_LOG_LEVEL value: "info" - name: KC_CACHE @@ -128,16 +130,23 @@ spec: - name: http containerPort: 8080 protocol: TCP + - name: management + containerPort: 9000 + protocol: TCP livenessProbe: httpGet: - path: / - port: http + path: /health/live + port: management initialDelaySeconds: 120 + periodSeconds: 15 timeoutSeconds: 5 + failureThreshold: 5 readinessProbe: httpGet: - path: /realms/master - port: http + path: /health/ready + port: management initialDelaySeconds: 60 - timeoutSeconds: 1 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 terminationGracePeriodSeconds: 60