Hi, We're running Keycloak in Kubernetes (in Google Cloud Platform) and instead of KUBE_PING we're using JDBC_PING (with a hosted MySQL by Google). Our changes are available in the following repo: https://github.com/akvo/akvo-keycloak On 01/17/2018 12:03 PM, Simon Payne wrote: -- Iván

You will have a dependency to the DB anyways, so I guess it would not hurt to use it for cluster discovery using JDBC_PING. It basically creates a table JGROUPSPING that gets updated as nodes join and leave the cluster. THowever, it seems to work a little differently depending on the DB type: on MySQL, the necessary table is created automatically while you have to do it yourself on Postgres (see https://github.com/jboss-dockerfiles/keycloak/pull/62) . Another reason to use a different mechanism like KUBE_PING could be if you want to experiment with different Keycloak clusters accessing the same database to move towards zero downtime updates (that's something sitting in my backlog). I lately also read recommendations to use DNS_PING (see https://github.com/jboss-dockerfiles/keycloak/pull/100) but I don’t have any personal experience with it... Best regards, Sebastian Mit freundlichen Grüßen / Best regards Dr.-Ing. Sebastian Schuster Engineering and Support (INST/ESY1) Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com Tel. +49 30 726112-485 | Fax +49 30 726112-100 | Sebastian.Schuster(a)bosch-si.com Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn -----Original Message----- From: keycloak-user-bounces(a)lists.jboss.org [mailto:keycloak-user-bounces@lists.jboss.org] On Behalf Of Simon Payne Sent: Freitag, 19. Januar 2018 11:48 To: keycloak-user <keycloak-user(a)lists.jboss.org&gt; Subject: Re: [keycloak-user] kubernetes thanks for the information both. I've managed to get KUBE_PING working. it appears that i was mainly missing the socket binding. I came across a pull request to https://github.com/jboss-dockerfiles/keycloak which had a build for kubernetes using KUBE_PING which has helped me a lot. With some modifications to the cache it appears to scale in kubernetes. The original fork can be found here https://github.com/rayscunningham/keycloak So how does JDBC_PING actually work and what is the dependency on mySQL? I wanted a protocol which was only dependent on kubernetes rather than any other component or network infrastructure allowing our cluster to be portable across different kubernetes implementations . Our production kubernetes will be hosted within another data centre thanks On Fri, Jan 19, 2018 at 8:29 AM, Iván Perdomo <ivan(a)akvo.org&gt; wrote: _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Why didn't you use KUBE_PING? Just curious. Is there one JGroups stack we can rally around for kubernetes? One to rule them all so that Keycloak just builds automatic support for it in the distro? I thought the value of kubernetes was supposed to be that you could make these kinds of protocol/network decisions upfront. On Fri, Jan 19, 2018 at 3:29 AM, Iván Perdomo <ivan(a)akvo.org&gt; wrote: -- Bill Burke Red Hat

We'll eventually put together a kub (and openshift) quickstart that sets up an ingress with SSL, db, clustered keycloak, and a secured app. Basically something you can spin up in minikube with little to no config with further docs on how to bring it into a real environment. A bunch of us have bits and pieces of this, but we haven't had the time to formalize and finish it. On Fri, Jan 19, 2018 at 8:42 AM, Simon Payne <simonpayne58(a)gmail.com&gt; wrote: -- Bill Burke Red Hat