checkfleet

Keycloak check

keycloak — Keycloak

Health endpoint UP and per-realm OIDC discovery — token endpoint present, issuer coherent.

checkfleet check keycloak --config checkfleet.yml

Keycloak health via HTTP/JSON — read-only, no admin credentials.

  • Health (when health_url is set): the endpoint (e.g. /health/ready, often on the management port) must report status: UP → OK; DOWN → BAD; unreachable → ERROR.
  • Per realm: the OIDC discovery document (/realms/<realm>/.well-known/openid-configuration) must return 200 with a token_endpoint → OK. A 404/invalid document → BAD (realm missing); an issuer that doesn’t end with /realms/<realm> → WARN (usually a proxy/frontend-URL misconfiguration); unreachable → ERROR.

Findings are labelled health and realm/<name>.

See Configuration → checks.keycloak.

See the full module reference for every check, or configuration for the config keys.