From e3bb10d9011492e0cdd050b8b4876c1ccb8b2212 Mon Sep 17 00:00:00 2001 From: Guido Grazioli Date: Thu, 28 Apr 2022 11:33:23 +0200 Subject: [PATCH] fix: ensure correct jvm java_home is set --- playbooks/keycloak.yml | 2 +- roles/keycloak/README.md | 3 ++- roles/keycloak/defaults/main.yml | 3 ++- roles/keycloak/handlers/main.yml | 2 +- roles/keycloak/meta/argument_specs.yml | 3 +++ roles/keycloak/tasks/rhsso_patch.yml | 2 +- roles/keycloak/tasks/systemd.yml | 10 ++++++++++ roles/keycloak/templates/keycloak-service.sh.j2 | 4 ++-- roles/keycloak/templates/keycloak-sysconfig.j2 | 3 ++- 9 files changed, 24 insertions(+), 8 deletions(-) diff --git a/playbooks/keycloak.yml b/playbooks/keycloak.yml index e4ac27c..2b222a5 100644 --- a/playbooks/keycloak.yml +++ b/playbooks/keycloak.yml @@ -6,4 +6,4 @@ collections: - middleware_automation.keycloak roles: - - middleware_automation.keycloak.keycloak + - keycloak diff --git a/roles/keycloak/README.md b/roles/keycloak/README.md index 7ef3cb5..c63085b 100644 --- a/roles/keycloak/README.md +++ b/roles/keycloak/README.md @@ -60,13 +60,14 @@ Role Defaults |`keycloak_jgroups_port`| jgroups cluster tcp port | `7600` | |`keycloak_management_http_port`| Management port | `9990` | |`keycloak_management_https_port`| TLS management port | `9993` | -|`keycloak_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` | |`keycloak_prefer_ipv4`| Prefer IPv4 stack and addresses for port binding | `True` | |`keycloak_config_standalone_xml`| filename for configuration | `keycloak.xml` | |`keycloak_service_user`| posix account username | `keycloak` | |`keycloak_service_group`| posix account group | `keycloak` | |`keycloak_service_pidfile`| pid file path for service | `/run/keycloak.pid` | |`keycloak_jvm_package`| RHEL java package runtime | `java-1.8.0-openjdk-devel` | +|`keycloak_java_home`| JAVA_HOME of installed JRE, leave empty for using specified keycloak_jvm_package RPM path | `None` | +|`keycloak_java_opts`| Additional JVM options | `-Xms1024m -Xmx2048m` | * Install options diff --git a/roles/keycloak/defaults/main.yml b/roles/keycloak/defaults/main.yml index f33d332..7ef632a 100644 --- a/roles/keycloak/defaults/main.yml +++ b/roles/keycloak/defaults/main.yml @@ -21,7 +21,8 @@ keycloak_rhsso_enable: "{{ True if rhsso_rhn_id is defined and rhn_username is d keycloak_offline_install: False ### Install location and service settings -keycloak_jvm_package: java-1.8.0-openjdk-devel +keycloak_jvm_package: java-1.8.0-openjdk-headless +keycloak_java_home: keycloak_dest: /opt/keycloak keycloak_jboss_home: "{{ keycloak_rhsso_installdir if keycloak_rhsso_enable else keycloak_installdir }}" keycloak_config_dir: "{{ keycloak_jboss_home }}/standalone/configuration" diff --git a/roles/keycloak/handlers/main.yml b/roles/keycloak/handlers/main.yml index dda3682..4dd6ba2 100644 --- a/roles/keycloak/handlers/main.yml +++ b/roles/keycloak/handlers/main.yml @@ -1,4 +1,4 @@ --- -- name: "Restart {{ keycloak.service_name }}" +- name: "Restart handler" ansible.builtin.include_tasks: restart_keycloak.yml listen: "restart keycloak" diff --git a/roles/keycloak/meta/argument_specs.yml b/roles/keycloak/meta/argument_specs.yml index 67121c2..24b644c 100644 --- a/roles/keycloak/meta/argument_specs.yml +++ b/roles/keycloak/meta/argument_specs.yml @@ -81,6 +81,9 @@ argument_specs: default: "java-1.8.0-openjdk-devel" description: "RHEL java package runtime rpm" type: "str" + keycloak_java_home: + description: "JAVA_HOME of installed JRE, leave empty for using specified keycloak_jvm_package RPM path" + type: "str" keycloak_dest: # line 24 of keycloak/defaults/main.yml default: "/opt/keycloak" diff --git a/roles/keycloak/tasks/rhsso_patch.yml b/roles/keycloak/tasks/rhsso_patch.yml index d4a4273..b290877 100644 --- a/roles/keycloak/tasks/rhsso_patch.yml +++ b/roles/keycloak/tasks/rhsso_patch.yml @@ -31,7 +31,7 @@ dest: "{{ patch_archive }}" owner: "{{ keycloak_service_user }}" group: "{{ keycloak_service_group }}" - mode: 0750 + mode: 0640 register: new_version_downloaded when: - not patch_archive_path.stat.exists diff --git a/roles/keycloak/tasks/systemd.yml b/roles/keycloak/tasks/systemd.yml index cfc3762..8145189 100644 --- a/roles/keycloak/tasks/systemd.yml +++ b/roles/keycloak/tasks/systemd.yml @@ -9,6 +9,14 @@ notify: - restart keycloak +- name: Determine JAVA_HOME for selected JVM RPM + shell: | + set -o pipefail + rpm -ql {{ keycloak_jvm_package }} | grep -Po '/usr/lib/jvm/.*(?=/bin/java$)' + args: + executable: /bin/bash + register: rpm_java_home + - name: "Configure sysconfig file for {{ keycloak.service_name }} service" become: yes ansible.builtin.template: @@ -17,6 +25,8 @@ owner: root group: root mode: 0644 + vars: + keycloak_rpm_java_home: "{{ rpm_java_home.stdout }}" notify: - restart keycloak diff --git a/roles/keycloak/templates/keycloak-service.sh.j2 b/roles/keycloak/templates/keycloak-service.sh.j2 index 2281b17..577959e 100755 --- a/roles/keycloak/templates/keycloak-service.sh.j2 +++ b/roles/keycloak/templates/keycloak-service.sh.j2 @@ -17,7 +17,7 @@ checkEnvVar() { # for testing outside systemd . /etc/sysconfig/keycloak -readonly KEYCLOAK_HOME={{ keycloak_jboss_home }} +readonly KEYCLOAK_HOME={{ keycloak.home }} readonly KEYCLOAK_BIND_ADDRESS=${KEYCLOAK_BIND_ADDRESS} readonly KEYCLOAK_HTTP_PORT=${KEYCLOAK_HTTP_PORT} readonly KEYCLOAK_HTTPS_PORT=${KEYCLOAK_HTTPS_PORT} @@ -27,7 +27,7 @@ readonly KEYCLOAK_PIDFILE={{ keycloak_service_pidfile }} set -u if [ ! -d "${KEYCLOAK_HOME}" ]; then - echo "KEYCLOAK_HOME (${KEYCLOAK_HOME}) is not a director or does not exists." + echo "KEYCLOAK_HOME (${KEYCLOAK_HOME}) is not a directory or does not exists." exit 1 fi diff --git a/roles/keycloak/templates/keycloak-sysconfig.j2 b/roles/keycloak/templates/keycloak-sysconfig.j2 index 15b777c..68474c3 100644 --- a/roles/keycloak/templates/keycloak-sysconfig.j2 +++ b/roles/keycloak/templates/keycloak-sysconfig.j2 @@ -1,6 +1,7 @@ # {{ ansible_managed }} JAVA_OPTS='{{ keycloak_java_opts }}' -JBOSS_HOME={{ keycloak_jboss_home }} +JAVA_HOME={{ keycloak_java_home | default(keycloak_rpm_java_home, true) }} +JBOSS_HOME={{ keycloak.home }} KEYCLOAK_BIND_ADDRESS={{ keycloak_bind_address }} KEYCLOAK_HTTP_PORT={{ keycloak_http_port }} KEYCLOAK_HTTPS_PORT={{ keycloak_https_port }}