[keycloak-dev] Error while updating jboss/keycloak from old :latest to newer :latest

[Marek Posolda]

On 08/08/18 09:36, Lukasz Lech wrote:
> Hello,
>
> I've started keycloak locally from docker image jboss/keycloak:latest
>
> Today I've pulled the image, and I've got the following error:
>
> Caused by: liquibase.exception.ValidationFailedException: Validation Failed:
>       1 change sets check sum
>            META-INF/jpa-changelog-authz-4.0.0.CR1.xml::authz-4.0.0.CR1::psilva at redhat.com is now: 7:57960fc0b0f0dd0563ea6f8b2e4a1707
>
>           at liquibase.changelog.DatabaseChangeLog.validate(DatabaseChangeLog.java:206)
>           at liquibase.Liquibase.listUnrunChangeSets(Liquibase.java:1139)
>           at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>           at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>           at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>           at java.lang.reflect.Method.invoke(Method.java:498)
>           at org.keycloak.common.util.reflections.Reflections.invokeMethod(Reflections.java:379)
> The problem is, I'm not sure what was the :latest state I was using, it was some snapshot of 4.0.0-Beta,
> I've tried to start now :latest, :4.0.0.Final, and :4.0.0.Beta3, but neither of them can work with the old database.
>
> Does it mean, that my current database is unusable and I need to start from scratch or there is some way to update it?
Not sure if there is still a way to update it now... The error you're 
seeing is triggered by Liquibase (DB migration tool used by Keycloak) as 
it sees the update in some changelog, which you had already migrated in 
your DB.

In general yes, in your production DB, you should ideally never use 
"some snapshot of 4.0.0-Beta" as there is a chance that DB would be 
already "partially" migrated to 4.0.0 and liquibase won't be able to 
reliably detect the state in which exactly the DB is.

So the possibility is to either:
- start from scratch
- Try to fix DB manually. You can inspect Keycloak changelog files and 
state of your DB and see whether you can try to apply some remaining 
changes manually or revert to the state before 4.0.0 and then re-trigger 
the migration. This may not be trivial to do, but it's helpful if you 
don't have any other way and you don't want to loose the data
>
> Should I never ever in the future use :latest image?
Probably not. It's not good that :latest points to some snapshot 
version. This is maybe something, we should improve on KC side.

But still, it's always better to use some "known" version instead of 
latest. I personally wouldn't use "latest" for anything in production.

Marek
>
> Best regards,
> Lukasz Lech
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev