KeycloakRealm Resource for cozy Realm Missing After Initial CozyStack Deployment

While following the documentation for Cluster Configuration and Deploy CozyStack, it’s not possible to proceed with Step 3 of the Enable OIDC guide because the 'cozy' realm is missing in the Keycloak instance.

It appears that the keycloak-configure HelmRelease should create a KeycloakRealm resource for the cozy realm, as defined in configure-kk.yaml. However, this resource is not present in my deployment:

# kubectl get KeycloakRealm -A
No resources found

This blocks the OIDC setup steps as the expected realm is not available.

If the cozy realm needs to be manually, it would be helpful to include instructions on how to do so in the documentation to avoid confusion.

values.yaml (for talm):

endpoint: "https://10.22.90.10:6443"
clusterDomain: cozy.local
floatingIP: 10.22.90.10
image: "ghcr.io/cozystack/cozystack/talos:v1.10.3"
podSubnets:
- 10.244.0.0/16
serviceSubnets:
- 10.96.0.0/16
advertisedSubnets:
- 10.22.90.0/24
oidcIssuerUrl: "https://keycloak.cozy.yeetlab.local/realms/cozy"
certSANs: []

cozystack-config.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: cozystack
  namespace: cozy-system
data:
  bundle-name: "paas-full"
  root-host: cozy.yeetlab.local
  api-server-endpoint: https://10.22.90.10:443
  ipv4-pod-cidr: "10.244.0.0/16"
  ipv4-pod-gateway: "10.244.0.1"
  ipv4-svc-cidr: "10.96.0.0/16"
  ipv4-join-cidr: "100.64.0.0/16"

I also have problems related to Keycloak and the realm cozy is not getting created.

Some kubectl commands

k -n cozy-keycloak get clusterkeycloak
NAME            CONNECTED
keycloak-cozy   false

k -n cozy-keycloak get ClusterKeycloakRealm
NAME                 AVAILABLE   REALM   CLUSTER-KEYCLOAK
keycloakrealm-cozy

The helmreleases are getting true

k -n cozy-keycloak get hr
NAME                 AGE    READY   STATUS
keycloak             40h    True    Helm upgrade succeeded for release cozy-keycloak/keycloak.v4 with chart [email protected]
keycloak-configure   129m   True    Helm upgrade succeeded for release cozy-keycloak/keycloak-configure.v4 with chart [email protected]
keycloak-operator    40h    True    Helm upgrade succeeded for release cozy-keycloak/keycloak-operator.v2 with chart [email protected]

And this causes my dashboard to not start.

k -n cozy-dashboard logs pods/dashboard-7777cd677d-bccmx auth-proxy
[2025/07/18 12:30:08] [options.go:77] WARNING: no explicit redirect URL: redirects will default to insecure HTTP
[2025/07/18 12:30:08] [provider.go:55] Performing OIDC Discovery...
[2025/07/18 12:30:08] [main.go:59] ERROR: Failed to initialise OAuth2 Proxy: error initialising provider: could not create provider data: error building OIDC ProviderVerifier: could not get verifier builder: error while discovery OIDC configuration: failed to discover OIDC configuration: unexpected status "404": {"error":"Realm does not exist"}

I was able to get it connected

k -n cozy-keycloak get clusterkeycloak
NAME            CONNECTED
keycloak-cozy   true

After that the realm cozy was created and my dashboard started.

I added insecureSkipVerify: true under .spec in the keycloak-cozy

k -n cozy-keycloak edit clusterkeycloaks keycloak-cozy

I noticed that the certificate used for keycloak and dashboard is still:

Common Name (CN)	Kubernetes Ingress Controller Fake Certificate
Organization (O)	Acme Co

And looking at the certificates its still says False:

k -n cozy-keycloak get certificate
NAME      READY   SECRET    AGE
web-tls   False   web-tls   40h

So the underlaying issue i guess is that the clusterissuer letsencrypt-prod is not able to get a signed certificate and for that i have to open up the cluster to internet and also do some DNS magic

Can confirm. I'm seeing the same behavior in my deployment.
Maybe following Step 3 of the Bootstrap an Air-Gapped Cluster Guide to add a CA Certificate could be also an option.
I could also imagine that there is an option to change the validation method from HTTP to DNS which would not require to expose the cluster directly to the internet.

VentByte (@VentByte)

Hi, VentByte (@VentByte). I'm Dosu, and I'm helping the cozystack team manage their backlog and am marking this issue as stale.

Issue Summary:

You reported that the expected 'cozy' KeycloakRealm resource was missing after deploying CozyStack, blocking OIDC setup.
Sparc0 confirmed the realm was not created initially, causing dashboard startup failures due to OIDC errors.
The root cause was identified as the clusterissuer failing to obtain a valid TLS certificate, likely due to missing internet exposure or DNS configuration.
Sparc0 resolved the issue by setting insecureSkipVerify: true in the ClusterKeycloak spec.
You suggested improvements like adding a CA certificate or switching validation from HTTP to DNS to avoid exposing the cluster.

Next Steps:

Please confirm if this issue is still relevant with the latest version of CozyStack; if so, you can keep the discussion open by commenting here.
Otherwise, I will automatically close this issue in 7 days.

Thanks for your understanding and contribution!

Navigation Menu

Repository navigation

KeycloakRealm Resource for cozy Realm Missing After Initial CozyStack Deployment #1215

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

KeycloakRealm Resource for cozy Realm Missing After Initial CozyStack Deployment #1215

Description

Activity

Sparc0 commented on Jul 18, 2025

Sparc0 commented on Jul 18, 2025

VentByte commented on Jul 28, 2025

dosubot commented on Oct 27, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions