9:55 p.m.
Hello Jonathan,
On Thu, 2018-09-06 at 23:58 +0000, Carrasco, Jonathan J (173F) wrote:
Hello.
I’m working on implementing Keycloak on ECS. The proposed architecture is:
2x – Keycloak Docker images (customized for Domain Mode)
RDS Postgres Instance
Before we move on to the LB topic: please remember that AWS (incl. ECS) doesn't allow
for IP multicast between the nodes/containers, and IP multicast is what Keycloak
clustering relies upon (at least in default configuration).
In more detail, you'll have to configure alternate node discovery mechanism for
JGroups, like JDBC_PING or S3_PING.
See the doc for more details, especially the "Troubleshooting AWS specifics"
section at the end:
https://blog.keycloak.org/2018/01/keycloak-cross-data-center-setup-in-aws...
Or google for "Keycloak AWS", there have been a lot of postings on this ML on
that topic.
My question- and I’m open to comments- is what is best practice for Load Balancing and
what is the community using? I was thinking of spinning up another docker instance with
Nginx for load balancing instead of Amazon’s ALB.
In addition to nginx, I'd also recommend that you take a look at HAProxy:
http://www.haproxy.org/
Nginx is a web server first and foremost, and reverse proxying / load balancing are kinda
secondary functions for Nginx.
On the other hand, haproxy implements a lot of LB-specific stuff, like e.g throttling
based on HTTP headers, which might be topical (depends on your architecture of course).
Is that something that makes sense or better to just use ALB?
This is pretty reasonable. The main points here are:
- you can have something more powerful and feature-rich than ALB;
- you can take full control of it.
For example, Keycloak recommends using sticky sessions for performance
purposes:
https://www.keycloak.org/docs/4.4/server_installation/#sticky-sessions
This is absolutely doable with nginx/HAproxy, but I'm not sure if it is
possible with ALB.
The reasoning that I want to have another instance for load balancing
is because I want to separate the credential collector. Is there some docs on best way to
execute separating the credential collector?
Could you please elaborate on what do you mean by "credential collector"?
Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training
Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info(a)acutus.pro
--
Jonathan Carrasco (173F)
Jet Propulsion Laboratory
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user