为Bitnami Keycloak中的Infinispan配置TLS

当然可以为Bitnami Keycloak Pod内的Infinispan实例开启SSL加密通信，以下是具体实现步骤：

1. 准备SSL证书 #

生成或获取用于Infinispan集群通信的SSL证书，建议使用集群内的CA（如cert-manager）签发自签证书：

• 创建包含keystore.jks、truststore.jks及对应密码的Kubernetes Secret，示例命令：

  kubectl create secret generic infinispan-ssl-secret \
    --from-file=keystore.jks=./keystore.jks \
    --from-file=truststore.jks=./truststore.jks \
    --from-literal=keystore-password=your-keystore-pass \
    --from-literal=truststore-password=your-truststore-pass
  

2. 修改Bitnami Keycloak配置 #

通过Chart的values.yaml配置环境变量和卷挂载，让Keycloak加载SSL证书并启用Infinispan SSL：

extraEnvVars:
  - name: KC_CACHE_STACK
    value: "kubernetes"
  - name: KC_INFINISPAN_SSL_ENABLED
    value: "true"
  - name: KC_INFINISPAN_SSL_KEY_STORE_PATH
    value: "/opt/bitnami/keycloak/certs/infinispan/keystore.jks"
  - name: KC_INFINISPAN_SSL_KEY_STORE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: infinispan-ssl-secret
        key: keystore-password
  - name: KC_INFINISPAN_SSL_TRUST_STORE_PATH
    value: "/opt/bitnami/keycloak/certs/infinispan/truststore.jks"
  - name: KC_INFINISPAN_SSL_TRUST_STORE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: infinispan-ssl-secret
        key: truststore-password

extraVolumeMounts:
  - name: infinispan-ssl-certs
    mountPath: "/opt/bitnami/keycloak/certs/infinispan"
    readOnly: true

extraVolumes:
  - name: infinispan-ssl-certs
    secret:
      secretName: infinispan-ssl-secret
      items:
        - key: keystore.jks
          path: keystore.jks
        - key: truststore.jks
          path: truststore.jks

3. （可选）自定义Infinispan Cache Stack #

如果需要更精细的SSL配置（如指定加密算法、证书别名），可以自定义Cache Stack文件：

• 创建cache-stack-custom-kubernetes.xml，添加SSL配置段：

  <infinispan>
    <cache-container name="keycloak">
      <transport lock-timeout="60000">
        <properties>
          <property name="configurationFile" value="default-configs/default-jgroups-kubernetes.xml"/>
          <property name="ssl.enabled" value="true"/>
          <property name="ssl.key-store.path" value="/opt/bitnami/keycloak/certs/infinispan/keystore.jks"/>
          <property name="ssl.key-store.password" value="${env.KC_INFINISPAN_SSL_KEY_STORE_PASSWORD}"/>
          <property name="ssl.trust-store.path" value="/opt/bitnami/keycloak/certs/infinispan/truststore.jks"/>
          <property name="ssl.trust-store.password" value="${env.KC_INFINISPAN_SSL_TRUST_STORE_PASSWORD}"/>
          <property name="ssl.cipher.suites" value="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"/>
        </properties>
      </transport>
    </cache-container>
  </infinispan>
  

• 将该文件通过ConfigMap挂载到Keycloak容器的/opt/bitnami/keycloak/conf/cache-stack目录，同时修改KC_CACHE_STACK环境变量为custom-kubernetes。

4. 验证配置 #

• 部署更新后的Keycloak，查看Pod日志，确认出现类似以下的SSL启用日志：

  INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000088: Unable to use any JGroups configuration mechanisms provided in properties {}. Using default JGroups configuration!
  INFO  [org.infinispan.CLUSTER] (keycloak-cache-init) ISPN000078: Starting JGroups channel ISPN
  INFO  [org.jgroups.protocols.SSL] (keycloak-cache-init) SSL layer enabled using keystore /opt/bitnami/keycloak/certs/infinispan/keystore.jks, truststore /opt/bitnami/keycloak/certs/infinispan/truststore.jks
  

• 可通过tcpdump在Pod内抓取7600端口（Infinispan默认通信端口）的流量，确认流量已加密。

内容的提问来源于stack exchange，提问作者jobin george