Repository navigation
Rolling update causes timeouts due to unfinished Infinispan sync (Keycloak 25 on AWS ECS Fargate) #37705
Replies: 1 comment
|
Keycloak supports rolling updates only when using the same (patch) version of Keycloak. While rolling updates of different (patch) versions usually work, this is not guaranteed to work (yet). For minor and major updates it is always recommended to shut down the old instances first due to DB migrations. Keycloak supports liveness and readiness probes on HTTP endpoints. Use those to determine if a Keycloak instance has started (see There is no other need to change the default Infinispan configuration. Note that Keycloak 25 is no longer supported for the community. As part of Keycloak 26.1 we added default support for |
Uh oh!
There was an error while loading. Please reload this page.
Hello Keycloak community,
When performing a rolling update on AWS ECS Fargate, Keycloak containers stop and restart before the Infinispan synchronization is complete. This causes timeouts and potential session inconsistencies. As a result, my cluster becomes unhealthy, and all tasks stop due to sync errors.
Since sessions are now stored in the database, I may need to adjust my Infinispan configuration to prevent issues during deployment.
Expected Behavior:
Keycloak should wait for Infinispan sync to finish before stopping a container.
The new container should not become healthy until the synchronization is fully completed.
The old container should not be terminated until the sync is finished.
Steps to Reproduce:
Deploy Keycloak 25 on AWS ECS Fargate with multiple tasks.
Perform a rolling update.
Observe timeouts and sync-related errors in logs.
Possible Solutions:
Any guidance on the best approach would be appreciated!
All reactions