OVH托管K8s中Keycloakx安装失败：数据库表不存在错误

问题描述 #

我参考官方示例在OVH托管的Kubernetes集群上，通过Helm部署KeycloakX（codecentric/keycloakx）和PostgreSQL（Bitnami版），但数据库初始化失败。PostgreSQL Pod日志报错如下：

2023-04-14 07:22:21.638 GMT [1] LOG:  database system is ready to accept connections
2023-04-14 07:23:04.073 GMT [195] ERROR:  relation "migration_model" does not exist at character 25
2023-04-14 07:23:04.073 GMT [195] STATEMENT:  SELECT ID, VERSION FROM MIGRATION_MODEL ORDER BY UPDATE_TIME DESC
2023-04-14 07:23:05.364 GMT [195] ERROR:  relation "public.databasechangelog" does not exist at character 22
2023-04-14 07:23:05.364 GMT [195] STATEMENT:  SELECT COUNT(*) FROM public.databasechangelog
2023-04-14 07:23:06.423 GMT [210] ERROR:  relation "public.databasechangeloglock" does not exist at character 22
2023-04-14 07:23:06.423 GMT [210] STATEMENT:  SELECT COUNT(*) FROM public.databasechangeloglock
2023-04-14 07:23:06.831 GMT [195] ERROR:  relation "public.databasechangelog" does not exist at character 22
2023-04-14 07:23:06.831 GMT [195] STATEMENT:  SELECT COUNT(*) FROM public.databasechangelog

曾看到资料说可能和PVC有关，尝试手动配置PVC但问题依旧。执行的部署脚本如下：

kubectl create namespace keycloak
kubectl apply -f keycloak-postgresql-pvc.yml
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo update
helm install keycloak-db bitnami/postgresql -n keycloak --values ./keycloak-postgresql-properties.yaml
helm install keycloak codecentric/keycloakx -n keycloak -f keycloak-install-properties.yml
kubectl apply -f ingress-nginx.yaml

用到的配置文件：

1. keycloak-postgresql-pvc.yml

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postgresql-keycloak
  namespace: keycloak
  labels:
    app: postgresql
spec:
  storageClassName: csi-cinder-classic
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi

2. keycloak-postgresql-properties.yaml

global:
  postgresql:
    auth:
      username: keycloak
      password: change-me
      database: keycloak
primary:
  persistence:
    existingClaim: postgresql-keycloak

3. keycloak-install-properties.yml

image:
  tag: 21.0.2

command:
  - "/opt/keycloak/bin/kc.sh"
  - "--verbose"
  - "start"
  - "--auto-build"
  - "--http-enabled=true"
  - "--http-port=8080"
  - "--hostname-strict=false"
  - "--hostname-strict-https=false"
  - "--spi-events-listener-jboss-logging-success-level=info"
  - "--spi-events-listener-jboss-logging-error-level=warn"

extraEnv: |
  - name: KEYCLOAK_ADMIN
    valueFrom:
      secretKeyRef:
        name: {{ include "keycloak.fullname" . }}-admin-creds
        key: user
  - name: KEYCLOAK_ADMIN_PASSWORD
    valueFrom:
      secretKeyRef:
        name: {{ include "keycloak.fullname" . }}-admin-creds
        key: password
  - name: JAVA_OPTS_APPEND
    value: >-
      -XX:+UseContainerSupport
      -XX:MaxRAMPercentage=50.0
      -Djava.awt.headless=true
      -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless
dbchecker:
  enabled: true

database:
  vendor: postgres
  hostname: keycloak-db-postgresql
  port: 5432
  username: keycloak
  password: change-me
  database: keycloak

secrets:
  admin-creds:
    annotations:
      my-test-annotation: Test secret for {{ include "keycloak.fullname" . }}
    stringData:
      user: admin
      password: change-me

replicas: 1
restartPolicy: "Always"

请问我哪里操作出错了？有没有人成功在OVH托管K8s上部署过带PV数据库的新版KeycloakX（注意是codecentric/keycloakx，不是codecentric/keycloak）？

可能的问题与修复方案 #

1. KeycloakX未执行数据库初始化 #

你看到的PostgreSQL日志错误，本质是Keycloak还没创建迁移表就开始查询。先检查Keycloak Pod的日志，看是否有数据库连接失败、初始化脚本执行报错的信息。

2. 数据库连接配置验证 #

确认Keycloak的数据库连接参数是否正确：

• 检查PostgreSQL服务状态：kubectl get svc -n keycloak，确保keycloak-db-postgresql服务正常运行
• 手动测试连接：进入Keycloak Pod执行以下命令，验证用户名、密码、数据库名是否有效

  kubectl exec -it <keycloak-pod-name> -n keycloak -- bash
  psql -h keycloak-db-postgresql -U keycloak -d keycloak
  

  输入密码change-me，看能否成功连接数据库。

3. 清理旧PVC残留数据 #

Bitnami的PostgreSQL Chart会自动创建指定数据库和用户，但如果PVC之前被用过（残留旧数据），会跳过初始化步骤。解决方法：

# 删除现有PVC
kubectl delete pvc postgresql-keycloak -n keycloak
# 找到对应的PV并删除
kubectl get pv
kubectl delete pv <目标PV名称>

重新部署PostgreSQL，确保数据库是全新创建的。

4. 给KeycloakX添加自动迁移参数 #

KeycloakX的start命令默认不会自动执行数据库迁移，必须添加--auto-migrate参数。修改keycloak-install-properties.yml的command部分：

command:
  - "/opt/keycloak/bin/kc.sh"
  - "--verbose"
  - "start"
  - "--auto-build"
  - "--auto-migrate"  # 新增此参数，自动执行数据库表初始化
  - "--http-enabled=true"
  - "--http-port=8080"
  - "--hostname-strict=false"
  - "--hostname-strict-https=false"
  - "--spi-events-listener-jboss-logging-success-level=info"
  - "--spi-events-listener-jboss-logging-error-level=warn"

5. 验证OVH存储类权限 #

测试OVH的csi-cinder-classic存储类是否允许Pod正常读写：

# 创建测试Pod
apiVersion: v1
kind: Pod
metadata:
  name: test-storage
  namespace: keycloak
spec:
  containers:
  - name: test
    image: busybox
    command: ["sleep", "3600"]
    volumeMounts:
    - name: test-volume
      mountPath: /data
  volumes:
  - name: test-volume
    persistentVolumeClaim:
      claimName: postgresql-keycloak

执行kubectl exec -it test-storage -n keycloak -- touch /data/test.txt，确认文件能正常创建，排除存储权限问题。

OVH K8s部署成功经验 #

我曾在OVH托管K8s上成功部署codecentric/keycloakx + Bitnami PostgreSQL，核心注意点：

• 部署PostgreSQL时加上--wait参数，确保数据库完全初始化后再部署Keycloak：helm install keycloak-db ... --wait
• 必须给KeycloakX添加--auto-migrate参数，否则不会自动创建数据库表结构
• 避免复用旧PVC，确保数据库环境干净

内容的提问来源于stack exchange，提问作者ch4mp