🥇Ke holo nei ʻo Keycloak ma ke ʻano HA ma nā Kubernetes

Aku; DR: e loaʻa kahi wehewehe o Keycloak, kahi ʻōnaehana hoʻokele e wehe i ke kumu, ka nānā ʻana o ka hale kūloko, nā kikoʻī hoʻonohonoho.

Hoʻolauna a me nā manaʻo nui

Ma kēia ʻatikala, e ʻike mākou i nā manaʻo kumu e hoʻomanaʻo ai i ka wā e kau ana i kahi pūʻulu Keycloak ma luna o nā Kubernetes.

Inā makemake ʻoe e ʻike hou aku e pili ana iā Keycloak, e ʻoluʻolu e nānā i nā loulou ma ka hope o ka ʻatikala. I mea e hoʻomaʻamaʻa hou aku ai, hiki iā ʻoe ke aʻo kā mākou waihona me kahi module e hoʻokō ai i nā manaʻo nui o kēia ʻatikala ( aia ka alakaʻi alakaʻi, ma kēia ʻatikala e loaʻa kahi ʻike o ka hāmeʻa a me nā hoʻonohonoho, kokoke. mea unuhi).

ʻO Keycloak kahi ʻōnaehana paʻakikī i kākau ʻia ma Java a kūkulu ʻia ma luna o kahi kikowaena noi. ʻĀhiu. I ka pōkole, ʻo ia kahi papa hana mana e hāʻawi i nā mea hoʻohana noiʻi federation a me SSO (hoʻopaʻa inoa hoʻokahi).

Ke kono nei mākou iā ʻoe e heluhelu i ka luna pūnaewele ai ole ia, Wikipedia no ka hoomaopopo piha ana.

Hoʻomaka Keycloak

Pono ʻo Keycloak i ʻelua mau kumu ʻikepili hoʻomau e holo:

He waihona i hoʻohana ʻia no ka mālama ʻana i ka ʻikepili hoʻomau, e like me ka ʻike e pili ana i nā mea hoʻohana
ʻO Datagrid cache, kahi i hoʻohana ʻia e hūnā i ka ʻikepili mai ka waihona, a me ka mālama ʻana i kekahi mau metadata pōkole a hoʻololi pinepine ʻia, e like me nā kau mea hoʻohana. Hoʻokō ʻia Infinispan, ʻoi aku ka wikiwiki ma mua o ka waihona. Akā i kekahi hihia, ʻo ka ʻikepili i mālama ʻia ma Infinispan he ephemeral - a ʻaʻole pono e mālama ʻia ma kahi i ka wā e hoʻomaka hou ai ka hui.

Hana ʻo Keycloak ma nā ʻano ʻano ʻehā:

maʻamau - hoʻokahi wale nō kaʻina hana, hoʻonohonoho ʻia ma o kahi faila kūʻokoʻa.xml
puʻupuʻu mau (koho kiʻekiʻe loaʻa) - pono nā kaʻina hana a pau e hoʻohana i ka hoʻonohonoho like, pono e hoʻonohonoho lima ʻia. Mālama ʻia nā ʻōkuhi ma kahi faila kūʻokoʻa-ha.xml, Eia kekahi, pono ʻoe e hana i kahi komo i ka ʻikepili a me kahi mea hoʻohālikelike ukana.
Puʻupuʻu domain - ʻo ka hoʻomaka ʻana i ka puʻupuʻu ma ke ʻano maʻamau e lilo koke i hana maʻamau a ʻoluʻolu hoʻi i ka ulu ʻana o ka puʻupuʻu, no ka mea i kēlā me kēia manawa āu e hoʻololi ai i ka hoʻonohonoho, pono ʻoe e hana i nā hoʻololi āpau ma kēlā me kēia node o ka hui. Hoʻoponopono ke ʻano hana o ke kikowaena i kēia pilikia ma o ka hoʻonohonoho ʻana i kahi waihona kaʻana like a me ka paʻi ʻana i ka hoʻonohonoho. Mālama ʻia kēia mau hoʻonohonoho i kahi faila domain.xml
Hoʻopili hou ma waena o nā kikowaena ʻikepili - inā makemake ʻoe e holo iā Keycloak i loko o kahi pūʻulu o nā kikowaena ʻikepili, ʻoi loa ma nā wahi ʻāina like ʻole. Ma kēia koho, e loaʻa i kēlā me kēia kikowaena data kona pūʻulu o nā kikowaena Keycloak.

Ma kēiaʻatikala e noʻonoʻo pono mākou i ka kohoʻelua,ʻo ia hoʻi puʻupuʻu maʻamau, a e hoʻopā iki mākou i ke kumuhana o ka hana hou ʻana ma waena o nā kikowaena data, no ka mea he mea kūpono ke holo i kēia mau koho ʻelua ma Kubernetes. ʻO ka mea pōmaikaʻi, ma Kubernetes ʻaʻohe pilikia me ka hoʻonohonoho ʻana i nā hoʻonohonoho o nā pods (Keycloak nodes), no laila puʻupuʻu domain ʻAʻole paʻakikī loa ka hana ʻana.

E ʻoluʻolu hoʻi e hoʻomaopopo i ka ʻōlelo puʻupuʻu a hiki i ka hopena o ka ʻatikala e pili wale ana i kahi pūʻulu Keycloak nodes e hana pū ana, ʻaʻohe pono e kuhikuhi i kahi hui Kubernetes.

Pūʻulu Keycloak mau

No ka holo ʻana i Keycloak ma kēia ʻano, pono ʻoe:

hoʻonohonoho i kahi waihona kaʻana like waho
e hoʻokomo i ka mea hoʻolike hoʻouka
loaʻa kahi pūnaewele kūloko me ke kākoʻo ip multicast

ʻAʻole mākou e nānā i ka hoʻonohonoho ʻana o ka waihona waho, no ka mea, ʻaʻole ia ke kumu o kēia ʻatikala. E noʻonoʻo kākou aia kahi waihona hana - a loaʻa iā mākou kahi pilina pili iā ia. E hoʻohui wale mākou i kēia ʻikepili i nā ʻano hoʻololi kaiapuni.

No ka hoʻomaopopo maikaʻi ʻana i ka hana ʻana o Keycloak i kahi puʻupuʻu failover (HA), he mea nui ia e ʻike i ka nui o ka hilinaʻi ʻana i nā mana clustering o Wildfly.

Hoʻohana ʻo Wildfly i kekahi mau subsystems, hoʻohana ʻia kekahi o lākou ma ke ʻano he mea kaulike, hoʻohana ʻia kekahi no ka failover. Hoʻomaopopo ka mea kaulike i ka loaʻa ʻana o ka noi ke hoʻonui ʻia ka puʻupuʻu puʻupuʻu, a ʻo ka failover e hōʻoia i ka loaʻa ʻana o ka noi inā ʻaʻole i hāʻule kekahi o nā node cluster. ʻO kekahi o kēia mau subsystem:

mod_cluster: E hana pū me Apache ma ke ʻano he mea hoʻohālikelike hoʻouka HTTP, pili i ka TCP multicast e ʻike i nā pūʻali ma ke ʻano maʻamau. Hiki ke pani ʻia me kahi mea kaulike waho.
infinispan: He huna huna e hoʻohana ana i nā kahawai JGroups ma ke ʻano he papa lawe. Eia hou, hiki iā ia ke hoʻohana i ka protocol HotRod e kamaʻilio me kahi pūʻulu Infinispan waho e hoʻonohonoho i nā ʻike cache.
jgroups: Hāʻawi i ke kākoʻo kamaʻilio pūʻulu no nā lawelawe i loaʻa loa e pili ana i nā kahawai JGroups. Hiki i nā paipu i kapa ʻia ke hoʻopili ʻia i nā manawa noi i loko o kahi puʻupuʻu i nā hui i loaʻa i ke kamaʻilio nā waiwai e like me ka hilinaʻi, ka hoʻonohonoho ʻana, a me ka ʻike i nā hemahema.

mea kaulike ukana

I ka hoʻokomo ʻana i kahi balancer ma ke ʻano he mea hoʻokele komo i loko o kahi pūʻulu Kubernetes, pono e hoʻomanaʻo i kēia mau mea:

ʻO ka hana a Keycloak e hōʻike ana ʻo ka helu mamao o ka mea kūʻai aku e hoʻopili ana ma o HTTP i ka kikowaena hōʻoia ʻo ia ka helu IP maoli o ka kamepiula mea kūʻai aku. Pono nā hoʻonohonoho kaulike a me ka komo ʻana e hoʻonohonoho pono i nā poʻomanaʻo HTTP X-Forwarded-For и X-Forwarded-Proto, a mālama i ka inoa kumu HOST. mana hou loa ingress-nginx (>0.22.0) hoʻopau iā ia ma ka paʻamau

Ho'ā hae proxy-address-forwarding ma ka hoʻonohonoho ʻana i kahi hoʻololi kaiapuni PROXY_ADDRESS_FORWARDING в true hāʻawi iā Keycloak i ka ʻike e holo ana ma hope o kahi mea koho.

Pono ʻoe e hoʻā nā kau pili i ke komo ana. Hoʻohana ʻo Keycloak i kā Infinispan puʻupuʻu huna huna e mālama i ka ʻikepili e pili ana i ke kau hōʻoia o kēia manawa a me ke kau mea hoʻohana. Hoʻokahi wale nō mea nona nā cache, ʻo ia hoʻi, ua mālama ʻia kēlā kau ma kekahi node cluster a pono nā nodes ʻē aʻe e noi mamao inā pono lākou e komo i kēlā kau.

ʻOiaʻiʻo, kūʻē i ka palapala, hoʻopili i kahi hālāwai me ka inoa kuki ʻaʻole i hana no mākou AUTH_SESSION_ID. Ua hoʻopili ʻo Keycloak i ka hoʻihoʻi hou ʻana, no laila makemake mākou e koho i kahi inoa kuki ʻē aʻe no ke kau paʻa.

Hoʻopili pū ʻo Keycloak i ka inoa o ka node i pane mua ʻia AUTH_SESSION_ID, a no ka hoʻohana ʻana o kēlā me kēia node i ka mana loaʻa i ka waihona like, kēlā me kēia pono loaʻa he ID node ʻokoʻa a kū hoʻokahi no ka mālama ʻana i nā kālepa. Paipai ʻia e hoʻokomo i loko JAVA_OPTS kiko'î jboss.node.name и jboss.tx.node.id kū hoʻokahi no kēlā me kēia node - hiki iā ʻoe, no ka laʻana, kau i ka inoa o ka pod. Inā hoʻokomo ʻoe i ka inoa o ka pod - mai poina e pili ana i ka palena ʻano 23 no nā loli jboss, no laila ʻoi aku ka maikaʻi o ka hoʻohana ʻana i StatefulSet, ʻaʻole Deployment.

ʻO kekahi rake - inā holoi ʻia a hoʻomaka hou ʻia ka pod, nalowale kāna cache. Ma ka noʻonoʻo ʻana i kēia, pono e hoʻonohonoho i ka helu o nā mea nona nā cache a pau i ka liʻiliʻi ʻelua, i mau ai kahi kope o ka cache. ʻO ka hoʻonā e holo palapala no Wildfly i ka hoʻomaka ʻana i ka pod, e hoʻokomo i loko o ka papa kuhikuhi /opt/jboss/startup-scripts i loko o ka pahu:

Maʻiʻo palapala

embed-server --server-config=standalone-ha.xml --std-out=echo
batch

echo * Setting CACHE_OWNERS to "${env.CACHE_OWNERS}" in all cache-containers

/subsystem=infinispan/cache-container=keycloak/distributed-cache=sessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=authenticationSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=actionTokens:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=clientSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineClientSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})
/subsystem=infinispan/cache-container=keycloak/distributed-cache=loginFailures:write-attribute(name=owners, value=${env.CACHE_OWNERS:1})

run-batch
stop-embedded-server

a laila hoʻonoho i ka waiwai o ka hoʻololi kaiapuni CACHE_OWNERS i ka mea i makemakeia.

Pūnaewele pilikino me ke kākoʻo ip multicast

Inā ʻoe e hoʻohana ana iā Weavenet e like me kāu CNI, e hana koke ana ka multicast - a ʻike kāu mau ʻōnae Keycloak kekahi i kekahi ke kū lākou a holo.

Inā ʻaʻohe ou kākoʻo ip multicast i kāu pūʻulu Kubernetes, hiki iā ʻoe ke hoʻonohonoho iā JGroups e hana pū me nā kuʻina ʻē aʻe e ʻimi ai i nā nodes.

ʻO ka koho mua e hoʻohana KUBE_DNShoʻohana headless service no ka huli ʻana i nā nodes Keycloak, e hāʻawi wale ʻoe iā JGroups i ka inoa o ka lawelawe e hoʻohana ʻia e ʻimi i nā nodes.

ʻO kekahi koho e hoʻohana i ke ʻano KUBE_PING, e hana pū me ka API e ʻimi i nā nodes (pono ʻoe e hoʻonohonoho serviceAccount me nā kuleana list и get, a laila hoʻonohonoho i nā pods e hana me kēia serviceAccount).

Pehea e ʻimi ʻia ai nā nodes no JGroups ma ka hoʻonohonoho ʻana i nā ʻano hoʻololi kaiapuni JGROUPS_DISCOVERY_PROTOCOL и JGROUPS_DISCOVERY_PROPERTIES. no ka KUBE_PING pono ʻoe e koho i nā pods ma ke noi ʻana namespace и labels.

️ Inā hoʻohana ʻoe i ka multicast a holo i ʻelua a ʻoi aku paha nā pūʻulu Keycloak i ka pūʻulu Kubernetes like (e ʻōlelo mākou i hoʻokahi ma ka inoa inoa. production, ka lua - staging) - hiki i nā nodes mai kekahi pūʻulu Keycloak ke hui pū me kekahi pūʻulu. E hoʻohana i ka helu helu multicast kū hoʻokahi no kēlā me kēia pūʻulu ma ka hoʻonohonoho ʻana i nā ʻano like ʻolejboss.default.multicast.address и jboss.modcluster.multicast.address в JAVA_OPTS.

Hoʻopili hou ma waena o nā kikowaena ʻikepili

ʻO ka hui

Hoʻohana ʻo Keycloak i nā puʻupuʻu cache Infinispan kaʻawale no kēlā me kēia kikowaena ʻikepili kahi i loaʻa ai nā pūʻulu Keycloack i hana ʻia me nā node Keycloak. Akā i ka manawa like, ʻaʻohe ʻokoʻa ma waena o Keycloak nodes ma nā kikowaena data like ʻole.

Hoʻohana nā node Keycloak i kahi Java Data Grid waho (nā kikowaena Infinispan) e kamaʻilio ma waena o nā kikowaena data. Hana ʻia ka kamaʻilio e like me ka protocol Infinispan HotRod.

Pono e hoʻonohonoho ʻia nā cache Infinispan me ke ʻano remoteStore, i hiki ke mālama i ka ʻikepili ma kahi mamao (ma kahi kikowaena ʻikepili ʻē aʻe, kokoke. mea unuhi) huna huna. Aia nā pūʻulu infinispan kaʻawale ma waena o nā kikowaena JDG, no laila mālama ʻia nā ʻikepili ma JDG1 ma ka pūnaewele site1 e hoʻopili hou ʻia iā JDG2 ma ka pūnaewele site2.

ʻO ka hope, hoʻolaha ka server JDG i nā kikowaena Keycloak o kāna puʻupuʻu ma o nā pilina mea kūʻai aku, ʻo ia kahi hiʻohiʻona o ka protocol HotRod. Hāʻawi ʻia nā kiko kīʻī site2 hoʻohou i kā lākou Infinispan caches a loaʻa ka hālāwai mea hoʻohana kūikawā ma nā nodes Keycloak ma site2.

Hiki nō hoʻi ke kākoʻo ʻole ʻia kekahi mau huna huna a hōʻole loa e kākau i ka ʻikepili ma o ka kikowaena Infinispan. No ka hana ʻana i kēia, pono ʻoe e wehe i ka hoʻonohonoho remote-store kikoʻī Infinispan cache (ma ka faila kūʻokoʻa-ha.xml), ma hope o kekahi mau kiko'ī replicated-cache ʻaʻole pono hou ma ka ʻaoʻao o ka kikowaena Infinispan.

Hoʻonohonoho i nā huna huna

ʻElua ʻano o ka hūnā ma Keycloak:

Kūloko. Aia ia ma ka ʻaoʻao o ke kumu, lawelawe e hōʻemi i ka ukana ma ka waihona, a me ka hoʻemi ʻana i ka latency pane. Mālama kēia ʻano cache i ke aupuni, nā mea kūʻai aku, nā kuleana, a me nā metadata mea hoʻohana. ʻAʻole hana hou ʻia kēia ʻano huna inā he ʻāpana kēia cache o kahi pūʻulu Keycloak. Inā hoʻololi kekahi komo i loko o ka cache, hoʻouna ʻia kahi leka hoʻololi i ke koena o nā kikowaena i loko o ka pūʻulu, a ma hope o ka wehe ʻia ʻana o ke komo ʻana mai ka cache. see wehewehe work E nānā ma lalo no ka wehewehe kikoʻī o ke kaʻina hana.
Hoʻopili hou. Hoʻoponopono i nā kau mea hoʻohana, nā hōʻailona hoʻopahemo, a me ka nānā ʻana i ka hāʻule ʻole ʻana e ʻike i nā hoʻāʻo phishing password a me nā hoʻouka ʻē aʻe. ʻO ka ʻikepili i mālama ʻia i loko o kēia mau huna he manawa pōkole, mālama ʻia i loko o RAM wale nō, akā hiki ke hana hou ʻia ma waena o ka pūʻulu.

Infinispan Caches

Nā Kau Kau - he manaʻo ma Keycloak, nā huna huna, i kapa ʻia authenticationSessions, hoʻohana ʻia e mālama i ka ʻikepili o nā mea hoʻohana kikoʻī. Pono ʻia nā noi mai kēia mau hūnā e ka polokalamu kele pūnaewele a me nā kikowaena Keycloak, ʻaʻole ma nā noi. ʻO kēia kahi e pāʻani ai ka hilinaʻi ʻana i nā kau paʻa, a ʻaʻole pono e hoʻihoʻi ʻia kēlā mau huna huna, ʻoiai ke ʻano o Active-Active mode.

Nā hōʻailona hana. ʻO kekahi manaʻo, hoʻohana pinepine ʻia no nā hiʻohiʻona like ʻole, i ka manawa, no ka laʻana, pono ka mea hoʻohana e hana i kekahi mea asynchronously ma ka leka uila. Eia kekahi laʻana, i ka wā o ke kaʻina hana forget password ʻānō actionTokens hoʻohana ʻia e hahai i nā metadata o nā hōʻailona pili - no ka laʻana, ua hoʻohana mua ʻia kahi hōʻailona a ʻaʻole hiki ke hoʻāla hou ʻia. Pono e hana hou ʻia kēia ʻano huna ma waena o nā kikowaena data.

Ka hoʻokolo ʻana a me ka pau ʻana o ka ʻikepili i mālama ʻia hana e hoʻomaha i ka ukana ma ka waihona. Hoʻonui kēia caching i ka hana akā hoʻohui i kahi pilikia maopopo. Inā hoʻololi kekahi kikowaena Keycloak i ka ʻikepili, pono e hoʻomaopopo ʻia ke koena o nā kikowaena i hiki iā lākou ke hoʻonui i kā lākou mau huna. Hoʻohana ʻo Keycloak i nā huna huna realms, users и authorization no ka hoʻopaʻa ʻana i ka ʻikepili mai ka waihona.

Aia kekahi huna huna work, i hana hou ʻia ma nā kikowaena ʻikepili āpau. ʻAʻole ʻo ia e mālama i kekahi ʻikepili mai ka waihona, akā lawelawe ia e hoʻouna i nā memo kahiko o ka ʻikepili i nā nodes cluster ma waena o nā kikowaena data. Ma nā huaʻōlelo ʻē aʻe, i ka wā e hoʻonui ʻia ai ka ʻikepili, hoʻouna ka Keycloak node i kahi leka i nā nodes ʻē aʻe i kāna kikowaena data, a me nā nodes i nā kikowaena data ʻē aʻe. I ka loaʻa ʻana mai o kēlā memo, hoʻomaʻemaʻe kēlā me kēia node i ka ʻikepili pili i loko o kāna mau huna kūloko.

Nā kau mea hoʻohana. Nā waihona me nā inoa sessions, clientSessions, offlineSessions и offlineClientSessions, e hoʻopili pinepine ʻia ma waena o nā kikowaena ʻikepili a lawelawe i ka mālama ʻana i nā ʻikepili e pili ana i nā kau mea hoʻohana e hana ana i ka wā e hana ana ka mea hoʻohana i ka polokalamu kele pūnaewele. Ke hana nei kēia mau cache me ka noi e lawelawe ana i nā noi HTTP mai nā mea hoʻohana hope, no laila pili lākou me nā kau paʻa a pono e hana hou ʻia ma waena o nā kikowaena data.

Ka pale ʻana i ka manaʻoʻino. Cache loginFailures Hoʻohana ʻia no ka hahai ʻana i ka ʻikepili kuhi hewa, e like me ka nui o ka manawa i hoʻokomo ai ka mea hoʻohana i ka ʻōlelo huna. ʻO ka hana hou ʻana o kēia huna huna ke kuleana o ka luna hoʻomalu. Akā no ka helu pololei ʻana, pono ia e hoʻāla i ka replication ma waena o nā kikowaena data. Akā ma ka ʻaoʻao ʻē aʻe, inā ʻaʻole ʻoe e hoʻopili i kēia ʻikepili, e hoʻomaikaʻi ʻoe i ka hana, a inā e kū mai kēia pilikia, ʻaʻole hiki ke hoʻāla ʻia ka hana hou ʻana.

I ka ʻōwili ʻana i kahi hui Infinispan, pono ʻoe e hoʻohui i nā wehewehe huna i ka faila hoʻonohonoho:

<replicated-cache-configuration name="keycloak-sessions" mode="ASYNC" start="EAGER" batching="false">
</replicated-cache-configuration>

<replicated-cache name="work" configuration="keycloak-sessions" />
<replicated-cache name="sessions" configuration="keycloak-sessions" />
<replicated-cache name="offlineSessions" configuration="keycloak-sessions" />
<replicated-cache name="actionTokens" configuration="keycloak-sessions" />
<replicated-cache name="loginFailures" configuration="keycloak-sessions" />
<replicated-cache name="clientSessions" configuration="keycloak-sessions" />
<replicated-cache name="offlineClientSessions" configuration="keycloak-sessions" />

Pono ʻoe e hoʻonohonoho a hoʻomaka i ka hui Infinispan ma mua o ka hoʻomaka ʻana i ka pūʻulu Keycloak

A laila pono ʻoe e hoʻonohonoho remoteStore no nā huna huna Keycloak. No ka hana ʻana i kēia, ua lawa kahi palapala, i hana ʻia e like me ka mea ma mua, i hoʻohana ʻia e hoʻonohonoho i ka loli CACHE_OWNERS, pono ʻoe e mālama iā ia i kahi faila a waiho i loko o kahi papa kuhikuhi /opt/jboss/startup-scripts:

Maʻiʻo palapala

embed-server --server-config=standalone-ha.xml --std-out=echo
batch

echo *** Update infinispan subsystem ***
/subsystem=infinispan/cache-container=keycloak:write-attribute(name=module, value=org.keycloak.keycloak-model-infinispan)

echo ** Add remote socket binding to infinispan server **
/socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=remote-cache:add(host=${remote.cache.host:localhost}, port=${remote.cache.port:11222})

echo ** Update replicated-cache work element **
/subsystem=infinispan/cache-container=keycloak/replicated-cache=work/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=work, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)

/subsystem=infinispan/cache-container=keycloak/replicated-cache=work:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache sessions element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=sessions/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=sessions, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=sessions:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache offlineSessions element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineSessions/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=offlineSessions, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineSessions:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache clientSessions element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=clientSessions/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=clientSessions, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=clientSessions:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache offlineClientSessions element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineClientSessions/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=offlineClientSessions, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineClientSessions:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache loginFailures element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=loginFailures/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    remote-servers=["remote-cache"], 
    cache=loginFailures, 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=loginFailures:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache actionTokens element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=actionTokens/store=remote:add( 
    passivation=false, 
    fetch-state=false, 
    purge=false, 
    preload=false, 
    shared=true, 
    cache=actionTokens, 
    remote-servers=["remote-cache"], 
    properties={ 
        rawValues=true, 
        marshaller=org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory, 
        protocolVersion=${keycloak.connectionsInfinispan.hotrodProtocolVersion} 
    } 
)
/subsystem=infinispan/cache-container=keycloak/distributed-cache=actionTokens:write-attribute(name=statistics-enabled,value=true)

echo ** Update distributed-cache authenticationSessions element **
/subsystem=infinispan/cache-container=keycloak/distributed-cache=authenticationSessions:write-attribute(name=statistics-enabled,value=true)

echo *** Update undertow subsystem ***
/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding,value=true)

run-batch
stop-embedded-server

Mai poina e hoʻouka JAVA_OPTS no nā node Keycloak e hana iā HotRod: remote.cache.host, remote.cache.port a me ka inoa lawelawe jboss.site.name.

Nā loulou a me nā palapala hou

Ua unuhi ʻia ka ʻatikala a hoʻomākaukau ʻia no Habr e nā limahana Ke kikowaena hoʻomaʻamaʻa Slurm - nā papa koʻikoʻi, nā wikiō wikiō a me nā hoʻomaʻamaʻa ʻoihana mai ka hoʻomaʻamaʻa loea (Kubernetes, DevOps, Docker, Ansible, Ceph, SRE)

Source: www.habr.com

Holo Keycloak ma ke ʻano HA ma nā Kubernetes