set auto-mount service account token to false in keycloak pods #40605

KyriosGN0 · 2025-06-18T21:56:17Z

KyriosGN0 · 2025-06-18T22:57:53Z

pretty sure the testNoAutoMountServiceAccount passed locally, just to be extra sure i will re-run it locally tomorrow

ahus1 · 2025-06-19T07:47:49Z

For the Keycloak Multi-Site setup, IMHO we assume that the CA used in OpenShift is imported automatically so we can communicate with Infinispan securely.

Looping in @ryanemerson / @pruivo to ensure that the docs are updated for that.

pruivo · 2025-06-20T07:45:48Z

For mult-site HA, Infinispan requires /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
Documentation

ahus1 · 2025-06-20T07:52:31Z

@pruivo - in addition to that, when Keycloak talks to Infinispan in that setup, it uses TLS. And to verify the Infinispan certificate, it needs to know about the CA. I remember there was some kind of mechanism.

Maybe @shawkins can refresh my memory here how Keycloak picks up that CA?

pruivo · 2025-06-20T08:05:00Z

@ahus1 The operator automatically adds the certificate to the truststore:

keycloak/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java

Lines 448 to 449 in 7736ca2

    
           // include the kube CA if the user is not controlling KC_TRUSTSTORE_PATHS via the unsupported or the additional 
        
           varMap.putIfAbsent(KC_TRUSTSTORE_PATHS, new EnvVarBuilder().withName(KC_TRUSTSTORE_PATHS).withValue(truststores).build());

ahus1 · 2025-06-20T08:10:55Z

@pruivo, thank you, I was looking for that code snippet but didn't find it. So this option would be required in the Keycloak HA setup as described in https://www.keycloak.org/high-availability/deploy-keycloak-kubernetes

So if this is merged for the 26.3 release and we decide to update the docs in a follow-up issue, that follow-up issue should be a blocker for the 26.3 release.

pruivo · 2025-06-20T08:23:16Z

@ahus1 How so? This PR is disabling the service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token ), and I don't find any relation to the service certificates in the Kubernetes docs.

ahus1 · 2025-06-20T08:25:32Z

@pruivo - OK, then I was just worried without a reason. Then proceed here, and our tests in the cluster will show if it breaks. Sorry for the noise!

pruivo · 2025-06-20T08:30:08Z

This is the only doc I found: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting
If something breaks after this PR is merged, we will know the culprit 🤣

vmuzikar · 2025-06-20T09:34:33Z

I don't find any relation to the service certificates in the Kubernetes docs

Based on #38843 (comment) it would appear that the CA cert is also not mounted when automountServiceAccountToken: false.

KyriosGN0 · 2025-06-20T11:33:43Z

@ahus1 How so? This PR is disabling the service account tokens (/var/run/secrets/kubernetes.io/serviceaccount/token ), and I don't find any relation to the service certificates in the Kubernetes docs.

the /var/run/secrets/kubernetes.io/serviceaccount/ca.crt (and that entire directory) is controlled by that flag, should i add the a clarification in some doc page that this option has to be true for multi-site setup in k8s?

vmuzikar · 2025-06-20T15:02:33Z

should i add the a clarification in some doc page that this option has to be true for multi-site setup in k8s?

+1

KyriosGN0 · 2025-06-28T13:39:25Z

added the automountServiceAccountToken: true to the example keycloak used in this doc

KyriosGN0 · 2025-07-12T08:44:05Z

Hey @vmuzikar would it be possible to get someone to take a look here?

Thanks in advance!

vmuzikar · 2025-07-14T07:27:21Z

@KyriosGN0 Sorry, will take a look this week.

...tor/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java

KyriosGN0 · 2025-07-14T22:08:09Z

@shawkins thanks for the review, i agree with your suggestion and have committed them

operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java

docs/guides/high-availability/examples/generated/keycloak.yaml

KyriosGN0 · 2025-08-07T09:48:13Z

@vmuzikar would it be possible for you take another look?
Thanks!

KyriosGN0 · 2025-10-06T08:19:39Z

hey @vmuzikar @stianst, is it possible to get a review here?

KyriosGN0 · 2025-10-24T15:55:00Z

hey @vmuzikar @stianst, is there something i can do to progress with this PR ?

shawkins · 2025-10-31T13:02:33Z

docs/guides/operator/advanced-configuration.adoc


 When running on a Kubernetes or OpenShift environment well-known locations of trusted certificates are included automatically.
 This includes `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` and the `/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt` when present.
+In order to not include `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` in Keycloak pods, set the `automountServiceAccountToken` field in the spec to `false`


Here, in the CRD property description, or both it should be clearer why you would want to set it to false and when that isn't possible.

If this seems like it's getting too nuanced, then I'm still in favor of using a networkpolicy that denies access from the keycloak pods to the api server.

@KyriosGN0 Sorry for the late reply.

If this seems like it's getting too nuanced

IMHO it's not.

@KyriosGN0 In order to move this forward, we would need to document that the service account is required by the Kube service accounts identity provider.

why you would want to set it to false

+1

And infinispan.

@shawkins do you mean using external infinispan cluster ?

Yes - #40605 (comment)

It can also be needed if there is custom provider logic that expects to connect to the api server.

@shawkins, @vmuzikar Done!

docs/guides/operator/advanced-configuration.adoc

shawkins

Thanks @KyriosGN0 this looks good. Just a couple of minor edits might be good.

vmuzikar

Thank you for the contribution, LGTM!

Signed-off-by: AvivGuiser <[email protected]> # Conflicts: # operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java

Signed-off-by: AvivGuiser <[email protected]>

Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

…ken to true Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

Signed-off-by: AvivGuiser <[email protected]>

…false Signed-off-by: AvivGuiser <[email protected]>

Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

This has been resolved by a docs note.

…oak#40605) closes keycloak#38843 Signed-off-by: AvivGuiser <[email protected]> Co-authored-by: Steven Hawkins <[email protected]>

Closes keycloak#44156 Signed-off-by: Giuseppe Graziano <[email protected]> Add permissions to stability-* workflows (keycloak#44212) Signed-off-by: stianst <[email protected]> Avoid downloading spotless dependencies every time Closes keycloak#44214 Signed-off-by: stianst <[email protected]> fix: correcting termination test on openshift (keycloak#44181) closes: keycloak#44179 Signed-off-by: Steve Hawkins <[email protected]> Translations update from Hosted Weblate (keycloak#44055) * Updated translation for Turkish Language: tr Update translation files Updated by "Cleanup translation files" hook in Weblate. Updated translation for Turkish Language: tr Updated translation for Turkish Language: tr Co-authored-by: Arif EROL <[email protected]> Co-authored-by: Hosted Weblate <[email protected]> Signed-off-by: Arif EROL <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> * Update translation files Updated by "Cleanup translation files" hook in Weblate. Co-authored-by: Hosted Weblate <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> * Updated translation for French Language: fr Updated translation for French Language: fr Update translation files Updated by "Cleanup translation files" hook in Weblate. Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Updated translation for French Language: fr Co-authored-by: Alexander Schwartz <[email protected]> Co-authored-by: Dodouce <[email protected]> Co-authored-by: Hosted Weblate <[email protected]> Co-authored-by: Sylvain Pichon <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Signed-off-by: Dodouce <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: Sylvain Pichon <[email protected]> * Update translation files Updated by "Cleanup translation files" hook in Weblate. Co-authored-by: Hosted Weblate <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> * Update translation files Updated by "Cleanup translation files" hook in Weblate. Updated translation for Chinese (Traditional Han script) Language: zh_Hant Updated translation for Chinese (Traditional Han script) Language: zh_Hant Co-authored-by: Hosted Weblate <[email protected]> Co-authored-by: 秉虎 <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: 秉虎 <[email protected]> --------- Signed-off-by: Arif EROL <[email protected]> Signed-off-by: Hosted Weblate <[email protected]> Signed-off-by: Alexander Schwartz <[email protected]> Signed-off-by: Dodouce <[email protected]> Signed-off-by: Sylvain Pichon <[email protected]> Signed-off-by: 秉虎 <[email protected]> Co-authored-by: Arif EROL <[email protected]> Co-authored-by: Alexander Schwartz <[email protected]> Co-authored-by: Dodouce <[email protected]> Co-authored-by: Sylvain Pichon <[email protected]> Co-authored-by: 秉虎 <[email protected]> Create remember_me column for user sessions Closes keycloak#44112 Signed-off-by: Pedro Ruivo <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]> Add optional parameter in WorkflowResource.toRepresentation to allow retrieval of the rep without the ids Closes keycloak#44183 Signed-off-by: Stefan Guilhen <[email protected]> Fix logger call to align arguments with format pattern fixes keycloak#44229 Signed-off-by: Lucas <[email protected]> MLDSA Keys and Feature-Flag Removing Feature-Flag set auto-mount service account token to false in keycloak pods (keycloak#40605) closes keycloak#38843 Signed-off-by: AvivGuiser <[email protected]> Co-authored-by: Steven Hawkins <[email protected]> Bug fix double-encoding for query parameter acr_values Related bug fix in Keycloak version 26.4 space with mutiple values results in → "+" → "%2B" Reported bug: keycloak#44125 Signed-off-by: jhgojbis <[email protected]> Fixing encoding of forwarded parameters Closes keycloak#44125 Signed-off-by: Pedro Igor <[email protected]> Fix UserSessionProviderOfflineModelTest#testLoadUserSessionsWithNotDeletedOfflineClientSessions Fixes keycloak#43886 Signed-off-by: Pedro Ruivo <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]> Deprecate TopologyInfo Closes keycloak#44047 Signed-off-by: Pedro Ruivo <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]> Find highest sequence number in jgroups_ping * Find the highest sequence number in jgroups_ping table to avoid duplicates Fixes keycloak#44189 Signed-off-by: Pedro Ruivo <[email protected]> Co-authored-by: Pedro Ruivo <[email protected]> Bump the actions-dependencies group with 3 updates (keycloak#44245) Bumps the actions-dependencies group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [github/codeql-action](https://github.com/github/codeql-action) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 4.6.2 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...330a01c) Updates `github/codeql-action` from 4.30.8 to 4.31.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f443b60...014f16e) Updates `actions/download-artifact` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@634f93c...018cc2c) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies - dependency-name: github/codeql-action dependency-version: 4.31.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-dependencies - dependency-name: actions/download-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Bump the actions-dependencies group with 3 updates (keycloak#44245) Bumps the actions-dependencies group with 3 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact), [github/codeql-action](https://github.com/github/codeql-action) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 4.6.2 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...330a01c) Updates `github/codeql-action` from 4.30.8 to 4.31.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@f443b60...014f16e) Updates `actions/download-artifact` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@634f93c...018cc2c) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies - dependency-name: github/codeql-action dependency-version: 4.31.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-dependencies - dependency-name: actions/download-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> JWK Algorithm Key Pair support (keycloak#44203) Closes keycloak#44141 Signed-off-by: stianst <[email protected]> Merge GenerateKeystoreForTestUtil with CryptoKeyStore (keycloak#44223) Closes keycloak#44195 Signed-off-by: stianst <[email protected]> Rename ApiUtil to AdminApiUtil (keycloak#44224) Closes keycloak#44196 Signed-off-by: stianst <[email protected]>

…oak#40605) closes keycloak#38843 Signed-off-by: AvivGuiser <[email protected]> Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: Ogenbertrand <[email protected]>

KyriosGN0 requested review from a team as code owners June 18, 2025 21:56

keycloak-github-bot bot added team/cloud-native labels Jun 18, 2025

shawkins reviewed Jul 14, 2025

View reviewed changes

...tor/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java Outdated Show resolved Hide resolved

...tor/src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java Outdated Show resolved Hide resolved

KyriosGN0 requested a review from a team as a code owner July 14, 2025 19:52

keycloak-github-bot bot added the team/sre label Jul 14, 2025

KyriosGN0 requested a review from shawkins July 14, 2025 22:07

vmuzikar requested changes Jul 17, 2025

View reviewed changes

operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java Outdated Show resolved Hide resolved

docs/guides/high-availability/examples/generated/keycloak.yaml Outdated Show resolved Hide resolved

keycloak-github-bot bot added the flaky-test label Jul 18, 2025

keycloak-github-bot bot mentioned this pull request Jul 18, 2025

Flaky test: org.keycloak.testsuite.cluster.JGroupsCertificateRotationClusterTest#testCoordinatorHasScheduleTask #39091

Closed

KyriosGN0 requested a review from vmuzikar July 24, 2025 19:51

KyriosGN0 force-pushed the automount2 branch from f3a3a91 to 64ad914 Compare August 7, 2025 09:46

shawkins reviewed Oct 31, 2025

View reviewed changes

KyriosGN0 requested a review from shawkins November 7, 2025 10:24

shawkins reviewed Nov 12, 2025

View reviewed changes

docs/guides/operator/advanced-configuration.adoc Outdated Show resolved Hide resolved

shawkins previously approved these changes Nov 12, 2025

View reviewed changes

KyriosGN0 dismissed shawkins’s stale review via e85f89d November 13, 2025 08:41

KyriosGN0 requested a review from shawkins November 13, 2025 08:41

vmuzikar approved these changes Nov 14, 2025

View reviewed changes

KyriosGN0 and others added 13 commits November 14, 2025 15:24

set auto-mount service account token to false in keycloak pods

6a2d932

Signed-off-by: AvivGuiser <[email protected]> # Conflicts: # operator/src/main/java/org/keycloak/operator/crds/v2alpha1/deployment/KeycloakSpec.java

add docs

904fe1a

Signed-off-by: AvivGuiser <[email protected]>

fix tests

274cf5c

Signed-off-by: AvivGuiser <[email protected]>

update the keycloak.yaml used for example in ha deployment in operator

f4bd402

Signed-off-by: AvivGuiser <[email protected]>

simplify getAutomountServiceAccountToken condition

b3a6011

Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

set truststores variable only if we set the automountServiceAccountTo…

b469e37

…ken to true Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

fix duplicate of truststore variable

b7e2452

Signed-off-by: AvivGuiser <[email protected]>

add warning about setting automountServiceAccountToken to false

2ed7679

Signed-off-by: AvivGuiser <[email protected]>

fix after rebase

9f58472

Signed-off-by: AvivGuiser <[email protected]>

fix after rebase

bd1f6d1

Signed-off-by: AvivGuiser <[email protected]>

fix after rebase

96c3542

Signed-off-by: AvivGuiser <[email protected]>

clairfy when its required to not set automountServiceAccountToken to …

6286915

…false Signed-off-by: AvivGuiser <[email protected]>

Update docs/guides/operator/advanced-configuration.adoc

deb64dd

Co-authored-by: Steven Hawkins <[email protected]> Signed-off-by: AvivGuiser <[email protected]>

vmuzikar force-pushed the automount2 branch from e85f89d to deb64dd Compare November 14, 2025 14:24

vmuzikar enabled auto-merge (squash) November 14, 2025 14:25

vmuzikar merged commit 3c8af6d into keycloak:main Nov 14, 2025
81 checks passed

KyriosGN0 deleted the automount2 branch December 16, 2025 17:08

set auto-mount service account token to false in keycloak pods #40605

set auto-mount service account token to false in keycloak pods #40605

Uh oh!

Conversation

KyriosGN0 commented Jun 18, 2025

Uh oh!

KyriosGN0 commented Jun 18, 2025

Uh oh!

ahus1 commented Jun 19, 2025

Uh oh!

pruivo commented Jun 20, 2025

Uh oh!

ahus1 commented Jun 20, 2025

Uh oh!

pruivo commented Jun 20, 2025

Uh oh!

ahus1 commented Jun 20, 2025

Uh oh!

pruivo commented Jun 20, 2025

Uh oh!

ahus1 commented Jun 20, 2025

Uh oh!

pruivo commented Jun 20, 2025

Uh oh!

vmuzikar commented Jun 20, 2025

Uh oh!

KyriosGN0 commented Jun 20, 2025

Uh oh!

vmuzikar commented Jun 20, 2025

Uh oh!

KyriosGN0 commented Jun 28, 2025

Uh oh!

KyriosGN0 commented Jul 12, 2025

Uh oh!

vmuzikar commented Jul 14, 2025

Uh oh!

Uh oh!

Uh oh!

KyriosGN0 commented Jul 14, 2025

Uh oh!

Uh oh!

Uh oh!

KyriosGN0 commented Aug 7, 2025

Uh oh!

KyriosGN0 commented Oct 6, 2025

Uh oh!

KyriosGN0 commented Oct 24, 2025

Uh oh!

shawkins Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

vmuzikar Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

shawkins Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

KyriosGN0 Oct 31, 2025

Choose a reason for hiding this comment

Uh oh!

shawkins Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

KyriosGN0 Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shawkins left a comment

Choose a reason for hiding this comment

Uh oh!

vmuzikar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

shawkins Oct 31, 2025 •

edited

Loading