如何通过Terraform Helm配置Keycloak输出全量登录日志到Stdout

要让Keycloak输出所有登录日志（成功+失败）到stdout，只需在你的Terraform Helm配置中添加针对org.keycloak.events包的DEBUG级别日志配置即可。Bitnami的Keycloak Chart支持通过logging.loggers参数直接配置特定包的日志级别，具体修改如下：

在现有的helm_release.keycloak资源中添加以下set块：

set {
  name  = "logging.loggers.org.keycloak.events"
  value = "DEBUG"
}

修改后的完整代码 #

resource "helm_release" "keycloak" {
  repository = "https://charts.bitnami.com/bitnami"
  chart      = "keycloak"
  namespace  = kubernetes_namespace.keycloak.metadata[0].name
  name       = "keycloak"

  # liveness and readiness probes are enabled by default
  set {
    name  = "replicaCount"
    value = 1
  }

  set {
    name  = "auth.adminUser"
    value = "admin"
  }

  set {
    name  = "auth.adminPassword"
    value = random_password.keycloak_admin.result
  }

  set {
    name  = "proxy"
    value = "edge"
  }

  set {
    name  = "postgresql.enabled"
    value = "false"
  }

  set {
    name  = "externalDatabase.host"
    value = module.keycloak_database.app_db_host
  }

  set {
    name  = "externalDatabase.port"
    value = "5432"
  }

  set {
    name  = "externalDatabase.user"
    value = module.keycloak_database.app_db_user
  }

  set {
    name  = "externalDatabase.password"
    value = module.keycloak_database.app_db_password
  }

  set {
    name  = "externalDatabase.database"
    value = module.keycloak_database.app_db_database
  }

  set {
    name  = "ingress.enabled"
    value = "true"
  }

  set {
    name  = "ingress.ingressClassName"
    value = "nginx"
  }

  set {
    name  = "ingress.hostname"
    value = "account.${local.domain}"
  }

  set {
    name  = "ingress.tls"
    value = "true"
  }

  set {
    name  = "ingress.annotations.cert-manager\.io/cluster-issuer"
    value = "letsencrypt"
  }

  set {
    name  = "ingress.annotations.cert-manager\.io/acme-challenge-type"
    value = "http01"
  }

  set {
    name  = "ingress.annotations.nginx\.ingress\.kubernetes\.io/proxy-buffer-size"
    value = "12k"
  }

  set {
    name  = "ingress.annotations.nginx\.ingress\.kubernetes\.io/force-ssl-redirect"
    value = "true"
    type  = "string"
  }

  set {
    name  = "service.sessionAffinity"
    value = "ClientIP"
  }

  set {
    name  = "serviceAccount.automountServiceAccountToken"
    value = "false"
  }

  set {
    name  = "production"
    value = "true"
  }

  set {
    name  = "service.type"
    value = "ClusterIP"
  }

  set {
    name  = "resources.limits.cpu"
    value = "1000m"
  }

  set {
    name  = "resources.limits.memory"
    value = "500Mi"
  }

  set {
    name  = "resources.requests.memory"
    value = "500Mi"
  }

  set {
    name  = "containerSecurityContext.enabled"
    value = "true"
    type  = "string"
  }

  set {
    name  = "containerSecurityContext.runAsUser"
    value = "1001"
  }

  set {
    name  = "containerSecurityContext.runAsNonRoot"
    value = "true"
  }

  set {
    name  = "containerSecurityContext.allowPrivilegeEscalation"
    value = "false"
  }

  # requires write access to fs
  set {
    name  = "containerSecurityContext.readOnlyRootFilesystem"
    value = "false"
  }

  # 新增：开启org.keycloak.events包的DEBUG日志，输出成功登录事件到stdout
  set {
    name  = "logging.loggers.org.keycloak.events"
    value = "DEBUG"
  }

}

说明 #

• 该配置通过Bitnami Chart提供的logging.loggers参数，将org.keycloak.events包的日志级别设置为DEBUG，这样Keycloak就会把成功登录事件和失败事件一起输出到stdout。
• 部署后，你可以通过kubectl logs <keycloak-pod-name>查看包含成功登录的完整日志。

内容的提问来源于stack exchange，提问作者One Developer