Repository navigation
Keycloak 26.8 Multi-Cluster v2 – CockroachDB Compatibility and Automatic Database HA Support #54409
Replies: 1 comment 2 replies
|
Hi! I'm not on the Keycloak team, but I went through the docs and the history of CockroachDB support, and I think this covers most of your questions. 1. CockroachDB with It is not supported. The supported databases page lists PostgreSQL, EnterpriseDB Advanced and Amazon Aurora PostgreSQL under You can find some background in the Phase Two article. To run Keycloak on CockroachDB they had to patch the code: they added the dialect and driver, ported the incompatible migrations and changed the transaction setup. They ship that as their own image, so it's a third party fork and not something the Keycloak project supports. 2. Multi-Cluster v2 Same answer, and the bar is even higher. The bare metal guide for v2 says any Keycloak supported database may be used if the deployment meets the HA, synchronous replication, consistency and latency requirements, and they ask for commit latency below 10 ms (below 5 ms recommended). The docs describe a reference setup with Aurora PostgreSQL, but as ahus1 clarified below, v2 supports all the databases on the supported list, and the team tests the stateless mode with all of them in CI. Since CockroachDB isn't a supported database in the first place, it doesn't qualify for v2 either. 3. Known limitations Besides the migrations and isolation level mentioned above, the main problem is that nobody upstream tests this combination. Any Keycloak upgrade can add a migration or a query that breaks on CockroachDB, and you would only find out during the upgrade. 4. Future support There was a plan once. Keycloak's new "map storage" supported CockroachDB, but the team stopped that work in October 2023 and began removing it from the codebase in Keycloak 23. That said, the team is now looking into official support for distributed databases in #52485, although there is no timeline yet and the scope hasn't been decided, so I wouldn't plan a production setup around it for now. 5. On premises HA without managing replication by hand Keycloak leaves this to the database layer. The bare metal guide says database HA design and failover are outside Keycloak and must be validated with the database vendor. In practice, the options that stay within the support matrix are:
Whatever you choose, check the commit latency between your sites before going ahead. If the round trip between the two data centers is already close to 10 ms, synchronous replication alone will push you over the limit for v2. Hope this helps! |
|
I agree that CockroachDB is not supported, and installation will fail as it is not 100% PostgreSQL compliant. In Multi-Cluster v2, we support all database, stated above. We test the stateless mode with all the supported databases in our CI, so we are very confident to state that Multi-Cluster v2 will work with all of the supported databases. As part of Keycloak, you'll find a CNPG setup ready to use, though CNPG will be synchronously replicated only within a single Kubernetes cluster AFAIK. We're currently looking into an official support for different distributed databases here #52485 but there is no timeline for that. And the scope has yet to be decided. |
|
Thanks for the corrections! I've updated my answer above to mention that v2 is tested with all the supported databases, the CNPG limitation within a single Kubernetes cluster, and the link to #52485. |
- 8000
Uh oh!
There was an error while loading. Please reload this page.
Hi Keycloak Team,
We are evaluating Keycloak 26.8 Multi-Cluster v2 for a production environment that requires high availability, automatic database replication, and failover.
According to the official documentation, Multi-Cluster v2 requires a highly available database with synchronous replication.
We are considering CockroachDB as an alternative to PostgreSQL because it provides built-in distributed replication, automatic failover, and node recovery.
We would appreciate clarification on the following questions:
CockroachDB Compatibility: Can Keycloak 26.8 work with CockroachDB using the PostgreSQL JDBC driver (
db=postgres), even though CockroachDB is not officially listed as a supported database?Multi-Cluster v2 Support: Is CockroachDB compatible with the Multi-Cluster v2 architecture, particularly its database-backed cache invalidation and session management mechanisms?
Known Limitations: Are there any known issues related to schema migrations, SQL compatibility, transaction handling, or locking when using CockroachDB?
Future Support: Are there any plans to officially support CockroachDB or other distributed SQL databases in upcoming Keycloak releases?
Recommended HA Solution: For an on-premises deployment, is there an officially supported database solution that provides automatic replication, failover, and recovery without requiring us to manually manage PostgreSQL streaming replication and failover?
Our primary goal is to implement a production-ready, highly available Keycloak deployment while minimizing the complexity of database replication, synchronization, and failover management.
Any recommendations, technical guidance, or documentation references would be greatly appreciated.
References:
Thanks in advance!
All reactions