Configure a dedicated Keycloak address pool for a management cluster

Applies to management clusters only

Caution

This section does not apply to existing management clusters that are migrated from MKE to k0s in MOSK 26.2 because they keep their current Keycloak address and require no changes.

You can still use this procedure to update the IP address of the Keycloak service on an existing management cluster migrated from MKE to k0s after bootstrap. In this case, configure the MetalLBConfig object instead of the templates/bm/metallbconfig.yaml.template file used in this section.

For the impact of this change on an existing cluster and the full procedure, see Update the Keycloak IP address on management clusters.

Note

This section is part of the Configure and verify MetalLB using the CLI procedure during the bootstrap of a management cluster.

A management cluster requires a dedicated MetalLB address pool for the Keycloak service. The Kubernetes API server of a k0s-based management cluster obtains its OIDC issuer address from this pool, so the address must be known in advance and must not change.

To configure a dedicated Keycloak address pool for management clusters:

  1. In templates/bm/metallbconfig.yaml.template, add an address pool named iam-keycloak to the ipAddressPools section.

    The pool must contain exactly one IP address in the /32 CIDR notation:

    spec:
  ipAddressPools:
  ...
  - name: iam-keycloak
    spec:
      addresses:
      - 192.168.9.99/32
      autoAssign: true
      avoidBuggyIPs: false
      serviceAllocation:
        priority: 10
        namespaces:
        - "kaas"
        serviceSelectors:
        - matchLabels:
            app.kubernetes.io/name: "keycloak"
            app.kubernetes.io/component: "http"

    Caution

    The pool name must be exactly iam-keycloak, and the pool must contain a single address in the /32 notation. Otherwise, the Kubernetes underlay configuration of the cluster cannot be generated and the cluster deployment stops.

  2. Ensure that the Keycloak address cannot be allocated from any other address pool. For this purpose, exclude the Keycloak service from other address pools using the serviceAllocation selectors. For example, for the default pool:

    serviceAllocation:
  serviceSelectors:
  - matchExpressions:
    - key: "app.kubernetes.io/name"
      operator: NotIn
      values: ["keycloak"]
  - matchExpressions:
    - key: "app.kubernetes.io/component"
      operator: NotIn
      values: ["http"]

  3. Announce the new pool on the appropriate interface by adding an l2Advertisements entry for it:

    - name: keycloak
  spec:
    interfaces:
    - k8s-lcm
    ipAddressPools:
    - iam-keycloak

    Caution

    The interface names listed in the interfaces field must match those used in templates/bm/ipam-objects.yaml.template for L2 templates.

  4. Continue with configuring templates/bm/metallbconfig.yaml.template as described in Configure and verify MetalLB using the CLI.

    If you are updating an existing cluster, proceed to Update the Keycloak IP address on management clusters.

See also