[keycloak-user] Keycloak in kubernetes cluster with AWS postgress: standalone-ha?

Tonnis Wildeboer tonnis at autonomic.ai
Fri Aug 25 13:27:39 EDT 2017


I am attempting to run Keycloak in a kubernetes cluster with a shared
postgres (RDS) db. Everything is hosted on AWS. The keycloak instances are
deployed using Helm.

I have read the clustering documentation and from that it seems that the
appropriate clustering mode in this scenario would be "Standalone Clustered
Mode".Therefore, I am using the "jboss/keycloak-ha-postgres" Docker image.
Since I am using the nginx Ingress controller I have the prescribed
PROXY_ADDRESS_FORWARDING=true environment variable. Upon inspection of the
Docker image, however, I noticed that the
$JBOSS_HOME/standalone/configuration/standalone-ha.xml file in that image
does not have the
proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING}" attribute in the
<http-listener ...> element. I also noticed that the
jboss-dockerfiles/keycloak-server base image has a sed command to add this
to the standalone.xml file but not to the standalone-ha.xml file.

Also, of the exmaples I have found via Google searches, I have not found
examples of deploying Keycloak this way, which is surprising. I have seen
examples with a single instance using the standalone postres image, but not
"Standalone Clustered".

So here are my questions:

1. What are the specific differences between using --server-config
standalone-ha.xml vs standalone.xml?
2. Is there communication between the pods that needs to happen when
running in "Standalone Clustered Mode"? (I ask this because I would need to
make sure that this is possible, possibly across VPCs.) If so, what is it?
I am hoping they just share a database.
3. Why doesn't the base jboss-dockerfiles/keycloak-server image also modify
the standalone-ha.xml file too, in the same way it modifies the
standalone.xml file: (
https://github.com/jboss-dockerfiles/keycloak/blob/0a54ccaccd5e27e75105b904708ac4ccd80df5c5/server/Dockerfile#L23-L25
)?
4. Is there any other documentation, etc that I should be looking at?

Thank you,

Tonnis


More information about the keycloak-user mailing list