Startup Fails with NullPointerException in Kubernetes with Keycloakx Helm chart

Area

dist/quarkus

Describe the bug

I have a simple installation of Keycloak on my Kubernetes cluster, I have installed this with the keycloakx Helm chart, and using the Quay.io docker image for Keycloak 20.0.0 I’m using the quarkus distro.

Usually updating Keycloak is a painless process, but unfortunately this time it has failed with the following error.

2022-11-09 23:50:53,910 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (production) mode
2022-11-09 23:50:53,912 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) Error details:: java.lang.NullPointerException
	at org.keycloak.migration.migrators.MigrateTo20_0_0.addViewGroupsRole(MigrateTo20_0_0.java:33)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:195)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:195)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:177)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:195)
	at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
	at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1801)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:497)
	at org.hibernate.query.spi.StreamDecorator.forEach(StreamDecorator.java:153)
	at org.keycloak.utils.ClosingStream.forEach(ClosingStream.java:128)
	at org.keycloak.migration.migrators.MigrateTo20_0_0.migrate(MigrateTo20_0_0.java:19)
	at org.keycloak.storage.datastore.LegacyMigrationManager.migrate(LegacyMigrationManager.java:133)
	at org.keycloak.migration.MigrationModelManager.migrate(MigrationModelManager.java:33)
	at org.keycloak.quarkus.runtime.storage.legacy.database.LegacyJpaConnectionProviderFactory.migrateModel(LegacyJpaConnectionProviderFactory.java:219)
	at org.keycloak.quarkus.runtime.storage.legacy.database.LegacyJpaConnectionProviderFactory.initSchema(LegacyJpaConnectionProviderFactory.java:213)
	at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:260)
	at org.keycloak.quarkus.runtime.storage.legacy.database.LegacyJpaConnectionProviderFactory.postInit(LegacyJpaConnectionProviderFactory.java:138)
	at org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSessionFactory.init(QuarkusKeycloakSessionFactory.java:104)
	at org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication.startup(QuarkusKeycloakApplication.java:42)
	at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver.onStartupEvent(QuarkusLifecycleObserver.java:37)
	at org.keycloak.quarkus.runtime.integration.QuarkusLifecycleObserver_Observer_onStartupEvent_b0e82415b143738dc1f986a5fa4668e83d0a5dea.notify(Unknown Source)
	at io.quarkus.arc.impl.EventImpl$Notifier.notifyObservers(EventImpl.java:326)
	at io.quarkus.arc.impl.EventImpl$Notifier.notify(EventImpl.java:308)
	at io.quarkus.arc.impl.EventImpl.fire(EventImpl.java:76)
	at io.quarkus.arc.runtime.ArcRecorder.fireLifecycleEvent(ArcRecorder.java:131)
	at io.quarkus.arc.runtime.ArcRecorder.handleLifecycleEvents(ArcRecorder.java:100)
	at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy_0(Unknown Source)
	at io.quarkus.deployment.steps.LifecycleEventsBuildStep$startupEvent1144526294.deploy(Unknown Source)
	at io.quarkus.runner.ApplicationImpl.doStart(Unknown Source)
	at io.quarkus.runtime.Application.start(Application.java:101)
	at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:110)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:69)
	at org.keycloak.quarkus.runtime.KeycloakMain.start(KeycloakMain.java:103)
	at org.keycloak.quarkus.runtime.cli.command.AbstractStartCommand.run(AbstractStartCommand.java:37)
	at picocli.CommandLine.executeUserObject(CommandLine.java:1939)
	at picocli.CommandLine.access$1300(CommandLine.java:145)
	at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2358)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2352)
	at picocli.CommandLine$RunLast.handle(CommandLine.java:2314)
	at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2179)
	at picocli.CommandLine$RunLast.execute(CommandLine.java:2316)
	at picocli.CommandLine.execute(CommandLine.java:2078)
	at org.keycloak.quarkus.runtime.cli.Picocli.parseAndRun(Picocli.java:93)
	at org.keycloak.quarkus.runtime.KeycloakMain.main(KeycloakMain.java:89)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.doRun(QuarkusEntryPoint.java:61)
	at io.quarkus.bootstrap.runner.QuarkusEntryPoint.main(QuarkusEntryPoint.java:32)

My Docker image is as follows

FROM quay.io/keycloak/keycloak:20.0.1 as builder

COPY themes/ /opt/keycloak/themes/
COPY realms /opt/keycloak/data/import

ENV KC_DB=postgres
ENV KC_HEALTH_ENABLED=true
ENV KC_HTTP_RELATIVE_PATH=/auth
ENV KC_FEATURES=token-exchange,admin-fine-grained-authz

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:20.0.1

COPY --from=builder /opt/keycloak/ /opt/keycloak/
WORKDIR /opt/keycloak

CMD ["-v", "start", "--import-realm", "--optimized"]

Version

20.0.0 (tested on 20.0.1 as well with the same behaviour)

Expected behavior

That the server starts without error.

Actual behavior

The server does not start, throwing the error above.

How to Reproduce?

1. Compile a similar Docker image using the Dockerfile shown in this issue
2. Helm deploy using the keycloakx helm chart

Anything else?

No response

[Swizz]

Following this, I naively exported one of the account-console client settings from another realm to the incriminated realm, and everything now works fine.

[sschu]

@vmuzikar @Spittal wrote “Usually updating Keycloak is a painless process, but unfortunately this time it has failed with the following error.”, that’s why I assumed he is updating from a previous version. In that case, deleting the “account-console” client is the likely cause.