Operator doesn't pass on system property 'jgroups.dns.query' to Keycloak but an env variable, leading to a warning in the log

[ahus1]

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest nightly release

Area

operator

Describe the bug

To configure discovery for Infinispan on Kubernetes, the docs as for the jgroups.dns.query to be added as a Java System Property using -D.... Instead the Operator passes an environment variable which leads to a warning.

Version

main

Expected behavior

No warning logged.

Actual behavior

Warning logged by Infinispan, which is misleading and wrong, as it is evaluated by JGroups in a second step:

ISPN000901: Property jgroups.dns.query could not be replaced as intended!

This is what is happening:

The Keycloak Operator set an environment variable jgroups.dns.query:

keycloak/operator/src/main/java/org/keycloak/operator/controllers/KeycloakDeployment.java

Lines 350 to 353 in fa83034

	new EnvVarBuilder()
	.withName("jgroups.dns.query")
	.withValue(getName() + Constants.KEYCLOAK_DISCOVERY_SERVICE_SUFFIX +"." + getNamespace())
	.build());

The environment variable is not visible inside of a shell, as shells ignore environment variable names which contain a dot. It is still there when I look at /proc/1/environ, and the Java process picks it up as it is started directly, and not from a shell.

After some debugging with @ryanemerson I found that Infinispan's StringPropertyReplacer doesn't look at environment variables and prints the warning, while JGroup's ProtocolConfiguration.substituteVariables calls Util.substituteVariable() which then takes into account the environment variables as well.

How to Reproduce?

Look at the logs of Keycloak started by the Operator in Kubernetes.

Anything else?

Looking at the JavaDoc of StringPropertyReplacer, environment variables need to be prefixed by env. to be replaced by Infinispan.

As we're using the default stacks and don't want to duplicate them, we can't use an environment variable.

The JAVA_OPTS shouldn't be overwritten, as it would overwrite all defaults in kc.sh. The JAVA_OPTS_APPEND is usually overwritten using the podTemplate, so if the Operator wants to use that path, it should only append that option there.