[PoC] Migration/Import in the background

Signed-off-by: Pedro Ruivo <1492066+pruivo@users.noreply.github.com>

Author: pruivo

quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java

@@ -96,6 +96,7 @@
 import org.keycloak.quarkus.runtime.integration.resteasy.KeycloakHandlerChainCustomizer;
 import org.keycloak.quarkus.runtime.integration.resteasy.KeycloakTracingCustomizer;
 import org.keycloak.quarkus.runtime.logging.ClearMappedDiagnosticContextFilter;
+import org.keycloak.quarkus.runtime.services.health.BoostrapReadyHealthCheck;
 import org.keycloak.quarkus.runtime.services.health.KeycloakClusterReadyHealthCheck;
 import org.keycloak.quarkus.runtime.services.health.KeycloakReadyHealthCheck;
 import org.keycloak.quarkus.runtime.storage.database.jpa.NamedJpaConnectionProviderFactory;
@@ -838,6 +839,7 @@ void disableHealthCheckBean(BuildProducer<BuildTimeConditionBuildItem> removeBea
         if (isHealthDisabled()) {
             disableReadyHealthCheck(removeBeans, index);
             disableClusterHealthCheck(removeBeans, index);
+            disableBootstrapReadyHealthCheck(removeBeans, index);
             return;
         }
         if (isMetricsDisabled()) {
@@ -860,6 +862,11 @@ private static void disableReadyHealthCheck(BuildProducer<BuildTimeConditionBuil
         removeBeans.produce(new BuildTimeConditionBuildItem(disabledBean.asClass(), false));
     }
 
+    private static void disableBootstrapReadyHealthCheck(BuildProducer<BuildTimeConditionBuildItem> removeBeans, CombinedIndexBuildItem index) {
+        ClassInfo disabledBean = index.getIndex().getClassByName(DotName.createSimple(BoostrapReadyHealthCheck.class.getName()));
+        removeBeans.produce(new BuildTimeConditionBuildItem(disabledBean.asClass(), false));
+    }
+
     @BuildStep
     void disableMdcContextFilter(BuildProducer<BuildTimeConditionBuildItem> removeBeans, CombinedIndexBuildItem index) {
         if (!Configuration.isTrue(LoggingOptions.LOG_MDC_ENABLED)) {

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/jaxrs/QuarkusKeycloakApplication.java

@@ -49,6 +49,7 @@ public class QuarkusKeycloakApplication extends KeycloakApplication {
     private static final String KEYCLOAK_ADMIN_PASSWORD_ENV_VAR = "KEYCLOAK_ADMIN_PASSWORD";
 
     private static final Logger logger = Logger.getLogger(QuarkusKeycloakApplication.class);
+    private static boolean bootstrapCompleted = false;
 
     @Override
     protected String getDataDir() {
@@ -104,6 +105,21 @@ protected void createTemporaryAdmin(KeycloakSession session) {
         }
     }
 
+    @Override
+    protected void onInitializationCompleted() {
+        bootstrapCompleted = true;
+    }
+
+    @Override
+    protected boolean supportsAsyncInitialization() {
+        // TODO support only for production environment, dev and non server probably won't need to do async init
+        return !org.keycloak.common.util.Environment.isNonServerMode();
+    }
+
+    public static boolean isBootstrapCompleted() {
+        return bootstrapCompleted;
+    }
+
     @Override
     protected int getTransactionTimeout(KeycloakSessionFactory sessionFactory) {
         return ((QuarkusJpaConnectionProviderFactory) sessionFactory.getProviderFactory(JpaConnectionProvider.class)).getMigrationTransactionTimeout();

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/BootstrapFilter.java

@@ -0,0 +1,26 @@
+package org.keycloak.quarkus.runtime.services;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.core.Response;
+
+import org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication;
+
+import org.jboss.resteasy.reactive.server.ServerRequestFilter;
+
+@ApplicationScoped
+public class BootstrapFilter {
+
+    @ServerRequestFilter(priority = 1)
+    public Response filter(ContainerRequestContext requestContext) {
+        if (QuarkusKeycloakApplication.isBootstrapCompleted()) {
+            // Return null to continue the request chain normally
+            return null;
+        }
+        // Return 503 Service Unavailable
+        return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                .entity("Keycloak is initializing...")
+                .build();
+
+    }
+}

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/health/BoostrapReadyHealthCheck.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.quarkus.runtime.services.health;
+
+import jakarta.enterprise.context.ApplicationScoped;
+
+import org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication;
+
+import io.smallrye.health.api.AsyncHealthCheck;
+import io.smallrye.mutiny.Uni;
+import org.eclipse.microprofile.health.HealthCheckResponse;
+import org.eclipse.microprofile.health.Readiness;
+
+@Readiness
+@ApplicationScoped
+public class BoostrapReadyHealthCheck implements AsyncHealthCheck {
+
+    @Override
+    public Uni<HealthCheckResponse> call() {
+        var builder = HealthCheckResponse.named("Keycloak Initialized");
+        if (QuarkusKeycloakApplication.isBootstrapCompleted()) {
+            builder.up();
+        } else {
+            builder.down();
+        }
+        return Uni.createFrom().item(builder.build());
+    }
+}

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/health/KeycloakClusterReadyHealthCheck.java

@@ -33,7 +33,7 @@
 
 public class KeycloakClusterReadyHealthCheck implements AsyncHealthCheck {
 
-    private final AtomicReference<Instant> failingSince = new AtomicReference<>();
+    private static final AtomicReference<Instant> failingSince = new AtomicReference<>();
 
     @Override
     public Uni<HealthCheckResponse> call() {

quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/health/KeycloakClusterReadyHealthCheckProducer.java

@@ -23,6 +23,7 @@
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
 import org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory;
 import org.keycloak.quarkus.runtime.integration.QuarkusKeycloakSessionFactory;
+import org.keycloak.quarkus.runtime.integration.jaxrs.QuarkusKeycloakApplication;
 
 import io.smallrye.health.api.AsyncHealthCheck;
 import org.eclipse.microprofile.health.Readiness;
@@ -34,6 +35,9 @@ public class KeycloakClusterReadyHealthCheckProducer {
     @Readiness
     @Dependent
     public AsyncHealthCheck createHealthCheck() {
+        if (!QuarkusKeycloakApplication.isBootstrapCompleted()) {
+            return null;
+        }
         var sessionFactory = QuarkusKeycloakSessionFactory.getInstance();
         InfinispanConnectionProviderFactory factory = (InfinispanConnectionProviderFactory) sessionFactory.getProviderFactory(InfinispanConnectionProvider.class);
         if (factory.isClusterHealthSupported()) {

services/src/main/java/org/keycloak/services/resources/KeycloakApplication.java

@@ -17,6 +17,7 @@
 package org.keycloak.services.resources;
 
 import java.io.File;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
 
 import jakarta.ws.rs.core.Application;
@@ -81,8 +82,37 @@ protected void initTmpDirectory() {
     protected void startup() {
         Profile.getInstance().logUnsupportedFeatures();
         CryptoIntegration.init(KeycloakApplication.class.getClassLoader());
-        KeycloakApplication.sessionFactory = createSessionFactory();
+        if (supportsAsyncInitialization()) {
+            CompletableFuture.runAsync(this::initializeAndStart)
+                    .exceptionally(throwable -> {
+                        exit(throwable);
+                        return null;
+                    });
+            return;
+        }
+        initializeAndStart();
+    }
+
+    protected void onInitializationCompleted() {
+
+    }
+
+    protected boolean supportsAsyncInitialization() {
+        return false;
+    }
+
+    private void initializeAndStart() {
 
+        var slowStartDelay = System.getProperty("org.keycloak.start-delay");
+        if (slowStartDelay != null) {
+            try {
+                Thread.sleep(TimeUnit.SECONDS.toMillis(Integer.parseInt(slowStartDelay)));
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+            }
+        }
+
+        KeycloakApplication.sessionFactory = createSessionFactory();
         setTransactionTimeout();
         var exportImportManager = KeycloakModelUtils.runJobInTransactionWithResult(sessionFactory, session -> {
             DBLockManager dbLockManager = new DBLockManager(session);
@@ -103,6 +133,9 @@ protected void startup() {
 
         resetTransactionTimeout();
         sessionFactory.publish(new PostMigrationEvent(sessionFactory));
+        onInitializationCompleted();
+        // TODO log duration
+        logger.info("Initialization completed");
     }
 
     protected int getTransactionTimeout(KeycloakSessionFactory sessionFactory) {