Is there a possibility to add a readiness check to check if the admin user exists?

[ZIRAKrezovic]

Description

I come from dasniko/testcontainers-keycloak#133 where we use Keycloak to test our app OAuth2/OpenID features via testcontainers framework.

However, most of the time the container is marked as "ready" (when calling /health endpoints) before the admin user has been created.

Is it possible to extend, either officially or via an extension, the readiness check to not mark the app as ready before the admin user has been initialized?

Discussion

No response

Motivation

No response

Details

No response

[dasniko]

@ahus1 Do you have some idea to this?

As @ZIRAKrezovic described in the mentioned dasniko/testcontainers-keycloak#133, the container is somehow "ready", but auth requests fail with a 401. Unfortunately, it's flaky (but occurs often).
In my default implementation I just tested the root path (/) for availability, but also when using the different health endpoints, this behavior occurs. And I tested all 4 health endpoints...

For the time being, I changed my wait strategy to observe the log output, but I don't like this approach, I'd love to have a reliable health endpoint.

[ahus1]

Thank you for raising this. I consider this a bug: Keycloak should have a startup probe which only returns OK once Keycloak is beyond that point.

Please create a bug issue for the Area "dist/quarkus", then post the issue number here so people can follow the link.

Note that this startup probe will only be available if the health probes are active - not sure if Testcontainers has that active by default.

[dasniko]

Thanks for responding, @ahus1. I'm not sure if I understand this properly.

Keycloak should have a startup probe

You mean there is already one, but it's not working properly? Or you say there's missing a probe?
And with that probe you mean a HEALTHCHECK property in the Dockerfile?

If a container has a HEALTHCHECK defined, I can "wait" for it with Testcontainers with a DockerHealthcheckWaitStrategy. Currently this fails, as there is nothing defined.

[ZIRAKrezovic]

Hi @ahus1, I have created an issue referencing this discussion #29072

[ahus1]

Sorry, it was late yesterday, and my note was a bit short: Yes, IMHO Keycloak is missing a Java class that hooks into the Quarkus startup probe which will then be part of /health/startup.

The Keycloak team should add the Java class, and you should call /health/startup for the testcontainer.