Name: ricplt-ckey-chart-ckey-0

Namespace: ricplt
Priority: 0
Service Account: ricplt-ckey-chart-ckey-stateful-sa
Node: rhocp-5-4pvzm-worker-0-s7ltw/5.0.0.15
Start Time: Wed, 05 Mar 2025 19:05:09 +0530
Labels: app=ckey
app.kubernetes.io/component=Security
app.kubernetes.io/instance=ricplt-ckey-chart
app.kubernetes.io/managed-by=Helm
app.kubernetes.io/name=ricplt-ckey-chart-ckey
app.kubernetes.io/part-of=ckey
app.kubernetes.io/version=12.3.1
controller-revision-hash=ricplt-ckey-chart-ckey-fd98d4fb8
helm.sh/chart=ckey-12.3.1
isu-upgrade=false
release=ricplt-ckey-chart
sidecar.istio.io/inject=false
statefulset.kubernetes.io/pod-name=ricplt-ckey-chart-ckey-0
Annotations: k8s.ovn.org/pod-networks:
{"default":{"ip_addresses":
["5.111.0.242/23"],"mac_address":"0a:58:05:6f:00:f2","gateway_ips":
["5.111.0.1"],"routes":[{"dest":"5.108.0.0/1...
k8s.v1.cni.cncf.io/network-status:
[{
"name": "ovn-kubernetes",
"interface": "eth0",
"ips": [
"5.111.0.242"
],
"mac": "0a:58:05:6f:00:f2",
"default": true,
"dns": {}
}]
kubectl.kubernetes.io/default-container: ricplt-ckey-chart-ckey
kubectl.kubernetes.io/default-exec-container: ricplt-ckey-chart-
ckey
openshift.io/scc: restricted-v2
rollme: Jz6mC
seccomp.security.alpha.kubernetes.io/pod: runtime/default
Status: Running
SeccompProfile: RuntimeDefault
IP: 5.111.0.242
IPs:
IP: 5.111.0.242
Controlled By: StatefulSet/ricplt-ckey-chart-ckey
Containers:
ricplt-ckey-chart-ckey:
Container ID:
cri-o://1fa6f83888a962fdb01284fa7e1e773b013e6fe2cc9aafb83980560189bf470f
Image:
edgeapps-docker-local.artifactory-blr1.int.net.nokia.com/ric/ckey-
keycloak:24.0.5.2-rocky8-jre17-47
Image ID:
edgeapps-docker-local.artifactory-blr1.int.net.nokia.com/ric/ckey-
keycloak@sha256:b31d29e730c2555ef6650a3c67c9d9944d8d7e883d77539d1fbfe93795e4ecdc
Ports: 8443/TCP, 7800/TCP, 57800/TCP
Host Ports: 0/TCP, 0/TCP, 0/TCP
State: Running
 Started: Wed, 05 Mar 2025 19:05:15 +0530
Ready: True
Restart Count: 0
Limits:
ephemeral-storage: 1Gi
memory: 2Gi
Requests:
cpu: 500m
ephemeral-storage: 1Gi
memory: 1Gi
Liveness: exec [sh -c CURL_TIMEOUT=5
ISTIO_ENABLED=false

#!/bin/bash
LIVENESS_LOG_FILE="/tmp/opt/keycloak/liveness.log"

log() {
if [ ! -f $LIVENESS_LOG_FILE ]
then
touch $LIVENESS_LOG_FILE
fi
echo ""$(date +'%Y-%m-%d %H:%M:%S,%3N') [quarkusLivenessprobe.sh] " $*" >>$
{LIVENESS_LOG_FILE}
}

PORT=${KC_HTTPS_PORT:-8443}
INGRESS_PATH=${KC_HTTP_RELATIVE_PATH:-"/"}
KEYCLOAK_URL="https://localhost:"${PORT}"${INGRESS_PATH}"/health
VERTX_URL="http://localhost:"${VERTX_HEALTH_CHECK_PORT}"/health"

KEYCLOAK_STATUS_CODE=$(curl -skL --max-time ${CURL_TIMEOUT} -w "%{http_code}" "$

{KEYCLOAK_URL}" -o /dev/null)
VERTX_STATUS_CODE=$(curl -sL --max-time ${CURL_TIMEOUT} -w "%{http_code}" "$
{VERTX_URL}" -o /dev/null)

# log "DEBUG Keycloak" "${KEYCLOAK_URL} returned response with $

{KEYCLOAK_STATUS_CODE}\n"
# log "DEBUG Logger" "${VERTX_URL} returned response with ${VERTX_STATUS_CODE}\n"

if [ "${KEYCLOAK_STATUS_CODE}" -eq '200' ] && [ "${VERTX_STATUS_CODE}" -eq '200' ];

then
exit 0
fi

log "ERROR: Exited with keycloak status ${KEYCLOAK_STATUS_CODE} and vertx status $
{VERTX_STATUS_CODE}"
exit 1

] delay=1s timeout=10s period=15s #success=1 #failure=5

Readiness: http-get https://:https-keycloak/usermgmt/health/ready delay=1s
timeout=1s period=2s #success=1 #failure=1
Startup: http-get https://:https-keycloak/usermgmt/health/ready delay=1s
timeout=1s period=2s #success=1 #failure=6000
Environment:
TZ: UTC
KC_HTTP_RELATIVE_PATH: /usermgmt
KC_PROXY_HEADERS: xforwarded
KC_SPI_STICKY_SESSION_ENCODER_INFINISPAN_SHOULD_ATTACH_ROUTE: false
KC_HOSTNAME_URL:
https://10.183.147.71:32311/usermgmt
KC_HOSTNAME_ADMIN_URL:
https://10.183.147.71:32311/usermgmt
KC_HOSTNAME_STRICT: true
KC_HOSTNAME_STRICT_BACKCHANNEL: true
KC_DB_URL_HOST: ricplt-cmdb-
chart-mysql.ricplt.svc.cluster.local
KC_DB: mariadb
KC_DB_URL_PORT: 3306
KC_DB_URL_DATABASE: db4keycloak
KC_DB_USERNAME: keycloak
KC_DB_URL_PROPERTIES: ?
autoReconnect=true
DB_IP: ricplt-cmdb-
chart-mysql.ricplt.svc.cluster.local
DB_PORT: 3306
DB_NAME: db4keycloak
DB_USER: keycloak
KC_HTTPS_PORT: 8443
DATABASE_RETRY_COUNTER: 12000
DATABASE_CHECK_TIMEGAP: 1000
DB_ALARM_CHECK_PERIOD: 30000
CERT_EXPIRY_ALARM_PERIOD: 10
ALARM_STATE_STORAGE: File
DATABASE_ALARM_INITIAL_DELAY: 240
KC_HEALTH_ENABLED: true
KC_METRICS_ENABLED: true
LDAP_HEALTH_ENABLED: true
LDAP_ALARM_INITIAL_DELAY: 240
REALM: master
COPYRIGHT_YEAR:
LB_BANNER_TITLE: Login Banner
LB_WELCOME_FIRST_NAME_MSG: Welcome, {0}.
LB_WELCOME_USERNAME_MSG: Welcome, {0}.
LB_PREVIOUS_SUCCESS_MSG: Your last
successful login was on {0}.
LB_FAILED_LOGIN_COUNTER_MSG: Failed login
attempts after last successful login
LB_MAIN_MSG: You are about
to access a private system. This system is for the use of authorized users only.
All connections are logged. Any unauthorized access or access attempts may be
punishable to the fullest extent possible under the applicable local legislation.
LB_ACCEPT_MSG: OK
MEMORY_LIMIT: 2048Mi
JAVA_OPTS_APPEND:
KCSH_COMMAND_LINE:
JGROUPS_DNS_QUERY: ricplt-ckey-
chart-ckey-headless.ricplt.svc.cluster.local
IP_FAMILY:
MEMORY_FACTOR_FOR_KEYCLOAK: 0.7
MEMORY_FACTOR_FOR_UNIFIED_LOGGER: 0.1
CKEY_POD_IP:
(v1:status.podIPs)
JGROUPS_BIND_PORT: 7800
JGROUPS_FD_OFFSET: 50000
KC_LOG_GELF_PORT: 8888
VERTX_HEALTH_CHECK_PORT: 8887
LOG4CXX_PROP_PATH:
/tmp/opt/keycloak/vertx/log4cxx.property
 KC_LOG: gelf
KC_LOG_LEVEL: INFO
KC_LOG_GELF_LEVEL: INFO
LOGGING_JAVA_OPTS: -
Djdk.internal.httpclient.disableHostnameVerification=true
QUARKUS_DATASOURCE_REACTIVE_IDLE_TIMEOUT: 15s
QUARKUS_DATASOURCE_JDBC_IDLE_REMOVAL_INTERVAL: 20s
QUARKUS_MICROMETER_BINDER_VERTX_ENABLED: true
QUARKUS_MICROMETER_BINDER_SYSTEM: true
QUARKUS_MICROMETER_BINDER_HTTP_CLIENT_ENABLED: true
QUARKUS_MICROMETER_BINDER_HTTP_SERVER_ENABLED: true
QUARKUS_DATASOURCE_METRICS_ENABLED: true
QUARKUS_MICROMETER_BINDER_JVM: true
QUARKUS_LOG_METRICS_ENABLED: true
QUARKUS_SCHEDULER_METRICS_ENABLED: true
QUARKUS_THREAD_POOL_MAX_THREADS: 50
JGROUPS_THREAD_POOL_MAX_THREADS: 100
KC_DB_POOL_MAX_SIZE: 25
QUARKUS_THREAD_POOL_QUEUE_SIZE: 1000
POD_NAMESPACE: ricplt
(v1:metadata.namespace)
URI_METRICS_ENABLED: true
URI_METRICS_DETAILED: false
PASSWORD_EXPIRY_THRESHOLD_DAYS: 15
SCHEDULE_AT_HOUR: 22
SCHEDULE_AT_MINUTES: 30
IS_EMAIL_NOTIFICATION_ENABLED: false
TEXT_BODY: Your WebSSO
login password is expiring soon. Please renew it.
Mounts:
/ckey/alarms from alarms (rw)
/ckey/custom-scripts from custom-ckey-scripts (ro)
/customProviders from ricplt-ckey-chart-ckey-custom-providers (rw)
/opt/etc/keycloak/custom-attributes-config.conf from custom-attribute-config
(rw,path="custom-attributes-config.conf")
/opt/etc/keycloak/notification-listener-registry.json from notification-
listener-config-json (rw,path="notification-listener-registry.json")
/opt/etc/keycloak/push-listener-registry.json from push-listener-config-json
(rw,path="push-listener-registry.json")
/opt/keycloak/security/ckey-secret/keycloak-admin-password from ckey-secret
(rw,path="keycloak-admin-password")
/opt/keycloak/security/ckey-secret/keycloak-admin-user from ckey-secret
(rw,path="keycloak-admin-user")
/opt/keycloak/vertx/log4cxx.property from logging-configuration
(rw,path="log4cxx.property")
/opt/keycloak/vertx/logging-extensions.json from logging-extensions
(rw,path="logging-extensions.json")
/tmp from ricplt-ckey-chart-ckey-tmp (rw)
Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
alarms:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in
the same namespace)
ClaimName: alarms-ricplt-ckey-chart-ckey-0
 ReadOnly: false
ricplt-ckey-chart-ckey-custom-providers:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit: <unset>
ricplt-ckey-chart-ckey-tmp:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit: <unset>
cbur-tmp:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit: <unset>
custom-ckey-scripts:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-custom-ckey-scripts
Optional: false
logging-configuration:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-logging-configuration
Optional: false
logging-extensions:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-logging-extensions
Optional: false
push-listener-config-json:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-push-listener
Optional: false
custom-attribute-config:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-custom-attributes
Optional: false
notification-listener-config-json:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: ricplt-ckey-chart-ckey-notification-listener
Optional: false
ckey-secret:
Type: Projected (a volume that contains injected data from
multiple sources)
SecretName: ricplt-ckey-chart-ckey
SecretOptionalName: 0xc0009b1597
QoS Class: Burstable
Node-Selectors: <none>
Tolerations: node.kubernetes.io/memory-pressure:NoSchedule op=Exists
node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for
300s
Events:
Type Reason Age From
Message
---- ------ ---- ----
-------
Warning FailedScheduling 78m default-scheduler 0/4
nodes are available: pod has unbound immediate PersistentVolumeClaims. preemption:
0/4 nodes are available: 4 Preemption is not helpful for scheduling..
Normal Scheduled 78m default-scheduler
Successfully assigned ricplt/ricplt-ckey-chart-ckey-0 to rhocp-5-4pvzm-worker-0-
s7ltw
 Normal SuccessfulAttachVolume 78m attachdetach-controller
AttachVolume.Attach succeeded for volume "pvc-ed18bb4a-fedd-4076-bd0a-a6cdfccba7b9"
Normal AddedInterface 78m multus Add
eth0 [5.111.0.242/23] from ovn-kubernetes
Normal Pulled 78m kubelet
Container image "edgeapps-docker-local.artifactory-blr1.int.net.nokia.com/ric/ckey-
keycloak:24.0.5.2-rocky8-jre17-47" already present on machine
Normal Created 78m kubelet
Created container ricplt-ckey-chart-ckey
Normal Started 78m kubelet
Started container ricplt-ckey-chart-ckey
Warning Unhealthy 78m (x22 over 78m) kubelet
Startup probe failed: Get "https://5.111.0.242:8443/usermgmt/health/ready": dial
tcp 5.111.0.242:8443: connect: connection refused