keycloak chart and istio about helm-charts

[denniseffing]

There are three possible solutions:

1. As a cluster operator, use Istio CNI instead of Istio init containers (Istio CNI documentation)
2. Use Istio version 1.1.3 or higher (1.1.3 includes a fix for this)
3. Change the Keycloak Helm chart so that securityContext is only defined on the main container instead of defining it on the top level spec. Defining it on the top level spec results in injected containers of Istio inherting the security context configuration, thus causing this issue.

[xeor]

1. As a cluster operator, use Istio CNI instead of Istio init containers (Istio CNI documentation)

Thanks for the tip.. This worked like a charm, and the "problem" gone "global". This is the solution

2. Use Istio version 1.1.3 or higher (1.1.3 includes a fix for this)

I was using 1.1.4, in the version that failed. I upgraded to 1.1.6 and enabled cni at the same time, so I'm not sure if 1.1.6 contains a fix or not..

3. Change the Keycloak Helm chart so that securityContext is only defined on the main container instead of defining it on the top level spec. Defining it on the top level spec results in injected containers of Istio inherting the security context configuration, thus causing this issue.

A best practice might be to set it on the container-level, but then fsGroup coulnt be used. Looks like keycloak starts fine without, but not sure if there are any other bugs related.

[denniseffing]

I was using 1.1.4, in the version that failed. I upgraded to 1.1.6 and enabled cni at the same time, so I'm not sure if 1.1.6 contains a fix or not..

I tested the Keycloak chart using 1.1.6 and didn't encouter any issues regarding the init containers. I didn't test 1.1.3 myself but atleast the changelog says that it fixed the issue by explicitly setting the securityContext.runAsUser to 0 (i.e. root) for istio-init.

A best practice might be to set it on the container-level, but then fsGroup coulnt be used. Looks like keycloak starts fine without, but not sure if there are any other bugs related.

fsGroup could still be used on PodSpecification, it does not interfere with istio-init. I'll work on a PR to support Istio 1.0.x.