Repository navigation
Supported options for running Keycloak 26 on Azure App Service Environment v3 (restricted ports)? #44684
Supported options for running Keycloak 26 on Azure App Service Environment v3 (restricted ports)?
#44684
Replies: 3 comments
|
Use --features=clusterless
--cache-remote-host=<your-infinispan-host>
--cache-remote-port=443
--cache-remote-username=<user>
--cache-remote-password=<pass>
--cache-remote-tls-enabled=trueThis offloads all session data to external Infinispan, allowing KC instances to run without inter-node clustering. Note: |
0 replies
|
We're currently experimenting with storing everything in the database, and having multiple clusters synchronizing via the DB. See #49469 It would allow you have a cluster size of 1, with no interactions between the nodes. |
0 replies
|
The feature was eventutally named "stateless", and is now fully supported in Keycloak 26.8 |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Background
Current: Keycloak 19.0.3, 3 instances on Azure App Service Environment v3 (ASE v3).
We have externalised caching using Infinispan remote-store in cache-ispn.xml so the three nodes shared state.
ASE v3 only allows certain inbound ports e.g. 80, 443, which worked for the app but not for cluster ports.
Problem upgrading to KC 26
KC 26 changes the caching model (persistent sessions by default; multi-site with external Infinispan via env/CLI; embedded clustering requires ports that ASE v3 can’t expose).
On ASE v3, multiple KC instances can’t form an embedded cluster due to blocked ports; XML remote-store is no longer the recommended path.
The only clear, supported path I see is migrating to AKS/VMs where we can open cluster ports.
Question
Is there any supported option (or one being considered) to run multiple Keycloak 26 instances on a service such as ASE v3 without opening custom inbound ports e.g. a supported single-site configuration using external Infinispan over Hot Rod/443 (configured via KC_CACHE_REMOTE_*) or another transport that works in PaaS environments? Or is moving to AKS/VMs the only viable route today?
Environment
Keycloak: upgrading 19.0.3 → 26.x
Platform: Azure App Service Environment v3 (inbound ports limited to 80/443)
Topology: 3 KC instances behind ASE; outbound VNet access available
What I’ve tried/considered
Embedded cluster: blocked by ASE v3 ports.
External Infinispan: unclear if single-site (non-multi-site) use is supported/recommended in KC 26 under ASE constraints.
Single instance with persistent sessions: loses HA.
All reactions