Repository navigation
Replies: 10 comments 24 replies
|
In working on this, I also encountered that there no longer appears to be a data source bound to JNDI for the Keycloak database. Is that correct? |
|
I'm unable to get this addition to the conf/cache-ispn.xml file to load a new stack: ...
<jgroups>
<stack name="jdbc-ping" extends="tcp">
<JDBC_PING connection_driver="org.postgresql.Driver"
connection_username="keycloak" connection_password="password"
connection_url="jdbc:postgres://postgres/keycloak" level="debug"
initialize_sql="CREATE TABLE IF NOT EXISTS JGROUPSPING (own_addr varchar(200) NOT NULL, cluster_name varchar(200) NOT NULL, ping_data BYTEA, constraint PK_JGROUPSPING PRIMARY KEY (own_addr, cluster_name));"
info_writer_sleep_time="500"
remove_all_data_on_view_change="true"
clear_table_on_view_change="true"
stack.combine="REPLACE"
stack.position="MPING" />
</stack>
</jgroups>
...perhaps due to this issue? #10052 |
|
Hi @thomasdarimont , I still got this error, even though I already set (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled |
|
nvm, the issue solved after I request to open all firewall ports between both VMs. |
@thomasdarimont I think we should be fine for k8s, no? The stack |
|
The default kubernetes stack uses DNS_PING, which works well in practice but is often replaced with kube_ping in customer projects. A working version for using KUBE_PING with Keycloak can be found here: https://github.com/codecentric/helm-charts/blob/master/charts/keycloakx/examples/postgresql-kubeping/cache-ispn-kubeping.xml#L12 |
|
AFAIK, DNS_PING is the preferable discovery protocol for k8s. At least that is the feedback we have from ISPN team. Could you elaborate why DNS_PING is not enough? Trying to understand if we need to review our defaults. |
|
I'm not sure if JDBC_PING is really something we should support at all, as it's mostly a workaround. What environment are you running in? Are there other protocols you could consider instead? |
|
There are 30+ installations that I have personally done using JDBC_PING. Some examples are:
Also, any installations where the goal is the reduce the number of external dependencies (a completely reasonable customer request), I have found that most gravitate to using JDBC_PING. My experience operating it has also been that it is reliable for moderately sized clusters, and standardization on it has made my and my customer administrator's lives easier. From the volume of messages on the various lists regarding people using JDBC_PING, I'm guessing I'm not the only one "doing it wrong". If Keycloak doesn't want to support it, that's obviously up to you. But if you do decide to support custom Infinispan configurations, could we keep this discussion alive for the purpose of sharing information on a common user need? Thank you. |
|
JDB_PING is one of the most flexible protocols, it's easy to use and works in nearly every environment. Therefore, I vote for keeping and supporting it! I can nearly second @xgp's arguments, and I also do have a couple of customers using JDBC_PING very successfully! Think of a on-premise environment, w/o OpenShift/K8s, not other Cloud-provider available/usable, no Multicast allowed/working, no dedicated hostnames/ip-addresses b/c of DNS, but the hosts use different hostnames/IPs, so querying the DNS does not make sense... What should customers do? |
|
We also use on almost all of our production installations the JDBC_PING protocol for the node discovery. I completely agree with @xgp and @dasniko (they explain perfectly why multicast in practice actually proves insufficient), therefore, you should double think before deciding to drop the jdbc_ping support. |
|
Whats the recommended stuff for k8s deployments @stianst dns ping, tcp ping?? |
|
Full working example here https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80 |
|
Thanks. The |
|
@thomasdarimont @xgp is there a way to make the database configuration to be read in the |
|
@nitishborade I'm not aware of a way to have it come from the Even if you are not running in Docker, you can still set the appropriate environment variables so that they are converted by |
|
@xgp Thanks for the prompt help. Yes setting as environment variables in the a startup script helps, however i just wanted to check if whether there was an approach to read from the |
|
HI @xgp @pedroigor @thomasdarimont, Do you guys have an example for aws s3 ping, we have an keycloak installed on top EKS cluster and worker nodes are based on ec2 instances. I followed the article "https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82" and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can set the jdbc_ping stack and table and records are created in the DB. I am trying to setup the aws s3 ping for my actual environment, I followed an article in keycloak but struck without the complete steps. |
|
For k8s Dns ping/k8s ping can be natural choice.. irrespecitve.of aks/eks.
not sure why you eant to use s3 ping... (s3 ping too should work though)..
Sent from Yahoo Mail on Android
On Tue, 26 Jul 2022 at 4:58 pm, ***@***.***> wrote:
HI @xgp @pedroigor @thomasdarimont,
Do you guys have an example for aws s3 ping, we have an keycloak installed on top EKS cluster and worker nodes are based on ec2 instances.
I followed the article "https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82" and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can set the jdbc_ping stack and table and records are created in the DB.
I am trying to setup the aws s3 ping for my actual environment, I followed an article in keycloak but struck without the complete steps.
It would be great if you have guys have done the similar setup at your end and need the steps for the same.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
|
|
Hi Madhu,
I followed the article "https://www.keycloak.org/server/caching" where
under section "*Additional transport stacks*" they mentioned that for
Amazon EC2 instances i need to use "ec2" stack. We have an EKS cluster
where worker nodes are built using Amazon EC2 instances. Hence I thought we
should use the "ec2" stack. Correct me if I'm wrong please.
…On Wed, 27 Jul 2022 at 10:00, kkcmadhu ***@***.***> wrote:
For k8s Dns ping/k8s ping can be natural choice.. irrespecitve.of aks/eks.
not sure why you eant to use s3 ping... (s3 ping too should work though)..
Sent from Yahoo Mail on Android
On Tue, 26 Jul 2022 at 4:58 pm, ***@***.***> wrote:
HI @xgp @pedroigor @thomasdarimont,
Do you guys have an example for aws s3 ping, we have an keycloak installed
on top EKS cluster and worker nodes are based on ec2 instances.
I followed the article "
https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82"
and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can
set the jdbc_ping stack and table and records are created in the DB.
I am trying to setup the aws s3 ping for my actual environment, I followed
an article in keycloak but struck without the complete steps.
It would be great if you have guys have done the similar setup at your end
and need the steps for the same.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
—
Reply to this email directly, view it on GitHub
<#10177 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AP4YZ5J7E3GWXP23ONCW7Q3VWC3NVANCNFSM5OHQJRUA>
.
You are receiving this because you commented.Message ID:
***@***.***>
--
Regards,
Arulaln A R
+91-8754438576
|
|
Hi Madhu,
Could you please check the below query. When I run the keycloak using EKS
cluster, can I still use the kubernetes stack?
…On Wed, 27 Jul 2022 at 13:34, Arulaln A R ***@***.***> wrote:
Hi Madhu,
I followed the article "https://www.keycloak.org/server/caching" where
under section "*Additional transport stacks*" they mentioned that for
Amazon EC2 instances i need to use "ec2" stack. We have an EKS cluster
where worker nodes are built using Amazon EC2 instances. Hence I thought we
should use the "ec2" stack. Correct me if I'm wrong please.
On Wed, 27 Jul 2022 at 10:00, kkcmadhu ***@***.***> wrote:
> For k8s Dns ping/k8s ping can be natural choice.. irrespecitve.of aks/eks.
> not sure why you eant to use s3 ping... (s3 ping too should work though)..
>
>
> Sent from Yahoo Mail on Android
>
> On Tue, 26 Jul 2022 at 4:58 pm, ***@***.***> wrote:
>
>
> HI @xgp @pedroigor @thomasdarimont,
>
> Do you guys have an example for aws s3 ping, we have an keycloak
> installed on top EKS cluster and worker nodes are based on ec2 instances.
>
> I followed the article "
> https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82"
> and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can
> set the jdbc_ping stack and table and records are created in the DB.
>
> I am trying to setup the aws s3 ping for my actual environment, I
> followed an article in keycloak but struck without the complete steps.
> It would be great if you have guys have done the similar setup at your
> end and need the steps for the same.
>
> —
> Reply to this email directly, view it on GitHub, or unsubscribe.
> You are receiving this because you commented.Message ID: ***@***.***>
>
> —
> Reply to this email directly, view it on GitHub
> <#10177 (comment)>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AP4YZ5J7E3GWXP23ONCW7Q3VWC3NVANCNFSM5OHQJRUA>
> .
> You are receiving this because you commented.Message ID:
> ***@***.***>
>
--
Regards,
Arulaln A R
+91-8754438576
--
Regards,
Arulaln A R
+91-8754438576
|
|
EKS is kubenetes(managed k8s) , so dns ping, k8s ping should just work oob for you.
Refer this thread for details Configuring distributed caches · Discussion #12022 · keycloak/keycloak
|
|
|
| | |
|
|
|
| |
Configuring distributed caches · Discussion #12022 · keycloak/keycloak
Hello, I managed to do this configuration in the Wildfly distribution. I can't do it in the Quarkus distribution...
|
|
|
Madhu
On Thursday, 28 July, 2022 at 08:08:47 pm IST, Arulaln-AR ***@***.***> wrote:
Hi Madhu,
Could you please check the below query. When I run the keycloak using EKS
cluster, can I still use the kubernetes stack?
…On Wed, 27 Jul 2022 at 13:34, Arulaln A R ***@***.***> wrote:
Hi Madhu,
I followed the article "https://www.keycloak.org/server/caching" where
under section "*Additional transport stacks*" they mentioned that for
Amazon EC2 instances i need to use "ec2" stack. We have an EKS cluster
where worker nodes are built using Amazon EC2 instances. Hence I thought we
should use the "ec2" stack. Correct me if I'm wrong please.
On Wed, 27 Jul 2022 at 10:00, kkcmadhu ***@***.***> wrote:
> For k8s Dns ping/k8s ping can be natural choice.. irrespecitve.of aks/eks.
> not sure why you eant to use s3 ping... (s3 ping too should work though)..
>
>
> Sent from Yahoo Mail on Android
>
> On Tue, 26 Jul 2022 at 4:58 pm, ***@***.***> wrote:
>
>
> HI @xgp @pedroigor @thomasdarimont,
>
> Do you guys have an example for aws s3 ping, we have an keycloak
> installed on top EKS cluster and worker nodes are based on ec2 instances.
>
> I followed the article "
> https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82"
> and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can
> set the jdbc_ping stack and table and records are created in the DB.
>
> I am trying to setup the aws s3 ping for my actual environment, I
> followed an article in keycloak but struck without the complete steps.
> It would be great if you have guys have done the similar setup at your
> end and need the steps for the same.
>
> —
> Reply to this email directly, view it on GitHub, or unsubscribe.
> You are receiving this because you commented.Message ID: ***@***.***>
>
> —
> Reply to this email directly, view it on GitHub
> <#10177 (comment)>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AP4YZ5J7E3GWXP23ONCW7Q3VWC3NVANCNFSM5OHQJRUA>
> .
> You are receiving this because you commented.Message ID:
> ***@***.***>
>
--
Regards,
Arulaln A R
+91-8754438576
--
Regards,
Arulaln A R
+91-8754438576
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
|
|
S3 ping are right choice if you are running keycloak on bare bone ec2.. since you are on 3ks, dns ping or k8s ping might work well ..
Sent from Yahoo Mail on Android
On Wed, 27 Jul 2022 at 1:35 pm, ***@***.***> wrote:
Hi Madhu,
I followed the article "https://www.keycloak.org/server/caching" where
under section "*Additional transport stacks*" they mentioned that for
Amazon EC2 instances i need to use "ec2" stack. We have an EKS cluster
where worker nodes are built using Amazon EC2 instances. Hence I thought we
should use the "ec2" stack. Correct me if I'm wrong please.
…On Wed, 27 Jul 2022 at 10:00, kkcmadhu ***@***.***> wrote:
For k8s Dns ping/k8s ping can be natural choice.. irrespecitve.of aks/eks.
not sure why you eant to use s3 ping... (s3 ping too should work though)..
Sent from Yahoo Mail on Android
On Tue, 26 Jul 2022 at 4:58 pm, ***@***.***> wrote:
HI @xgp @pedroigor @thomasdarimont,
Do you guys have an example for aws s3 ping, we have an keycloak installed
on top EKS cluster and worker nodes are based on ec2 instances.
I followed the article "
https://gist.github.com/thomasdarimont/47fc89ca8f51f5142418c3318c0d2e82"
and "https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80". Can
set the jdbc_ping stack and table and records are created in the DB.
I am trying to setup the aws s3 ping for my actual environment, I followed
an article in keycloak but struck without the complete steps.
It would be great if you have guys have done the similar setup at your end
and need the steps for the same.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
—
Reply to this email directly, view it on GitHub
<#10177 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AP4YZ5J7E3GWXP23ONCW7Q3VWC3NVANCNFSM5OHQJRUA>
.
You are receiving this because you commented.Message ID:
***@***.***>
--
Regards,
Arulaln A R
+91-8754438576
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.Message ID: ***@***.***>
|
Uh oh!
There was an error while loading. Please reload this page.
I've read the new documentation on setting up distributed caching (https://www.keycloak.org/server/caching). I'm unable to find information on support for using
JDBC_PINGdiscovery protocol for JGroups/Infinispan.I used to set this up (via the Docker image) by setting the following two environment variables:
This doesn't appear to be supported any longer, as it was something that got processed in the "legacy" docker container. Also, it doesn't appear to have support as one of the "cache stacks" in the new Quarkus distribution.
Is there documentation on how to migrate from this discovery protocol, or is it possible to specify this in a custom
conf/cache-ispn.xmlfile?All reactions