libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Update the HA guide with the workaround for ISPN-15758

Browse source 
Closes #27353

Signed-off-by: Michal Hajas <mhajas@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
This commit is contained in:
Michal Hajas 2024-02-28 16:56:15 +01:00 committed by GitHub
parent ade3b31a91
commit d7c6464ad6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 17 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
docs/guides/high-availability/connect-keycloak-to-external-infinispan.adoc
View file

@ -23,9 +23,10 @@ This topic describes advanced {jdgserver_name} configurations for {project_name}
include::examples/src/kcb-infinispan-cache-remote-store-config.xml[tag=keycloak-ispn-remotestore]
----
<1> New tag `<persistence />` to connect it to the remote store.
<2> For the address to the remote store, reference two environment variables for host name and port number.
<3> For authentication, reference two environment variables for username and password.
<4> To secure the remote store connection, use the Kubernetes mechanisms of the pre-configured truststore.
<2> This is a workaround for issue https://github.com/keycloak/keycloak/issues/27117[keycloak#27117] and will be removed in the following versions.
<3> For the address to the remote store, reference two environment variables for host name and port number.
<4> For authentication, reference two environment variables for username and password.
<5> To secure the remote store connection, use the Kubernetes mechanisms of the pre-configured truststore.
.. Prepare an {jdgserver_name} Cache configuration XML from the file `cache-ispn.xml`, which is part of the {project_name} distribution.
For each `replicated-cache` entry, add the tag `<persistence />` as shown below.

2
docs/guides/high-availability/examples/generated/ispn-single.yaml
View file

@ -224,7 +224,7 @@ spec:
expose:
type: Route
configMapName: "cluster-config"
image: quay.io/infinispan/server:14.0.24.Final
image: quay.io/infinispan/server:14.0.25.Final
configListener:
enabled: false
container:

2
docs/guides/high-availability/examples/generated/ispn-site-a.yaml
View file

@ -363,7 +363,7 @@ spec:
expose:
type: Route
configMapName: "cluster-config"
image: quay.io/infinispan/server:14.0.24.Final
image: quay.io/infinispan/server:14.0.25.Final
configListener:
enabled: false
container:

2
docs/guides/high-availability/examples/generated/ispn-site-b.yaml
View file

@ -363,7 +363,7 @@ spec:
expose:
type: Route
configMapName: "cluster-config"
image: quay.io/infinispan/server:14.0.24.Final
image: quay.io/infinispan/server:14.0.25.Final
configListener:
enabled: false
container:

5
docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
View file

@ -111,6 +111,9 @@ data:
raw-values="true"
shared="true"
segmented="false">
<!-- This is a workaround for the following issue https://github.com/keycloak/keycloak/issues/27117 and should be removed when the issue is fixed -->
<write-behind modification-queue-size="1024"/>
<!-- End of the workaround -->
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/> <!--2-->
<connection-pool max-active="16"
@ -790,7 +793,7 @@ spec:
podTemplate:
metadata:
annotations:
checksum/config: 2cae63c85a3485c135aebe1472971dd056b1dda42fb54ef2f891bc521e31fc1a-4832924b47210161956e3b1718daf07ff52d801545186a76c391485eaf1897d3-<KEYCLOAK_IMAGE_HERE>-56f92cd9012613402e2a7a61aded0f218d077b8c6345b22922ca7bf1a5c64984-v1.27.0
checksum/config: ebe9b8c121995f449a1a4e339af244b2bb67769af84b3cbdff61159948447e20-4832924b47210161956e3b1718daf07ff52d801545186a76c391485eaf1897d3-<KEYCLOAK_IMAGE_HERE>-dbc855dd9b7f7c0b828760ea8cd7427e8a2f5a5be303fba7dee0c6bbb68258d4-v1.27.0
spec:
containers:
- env:

9
docs/guides/high-availability/examples/src/kcb-infinispan-cache-remote-store-config.xml
View file

@ -53,20 +53,23 @@
raw-values="true"
shared="true"
segmented="false">
<!-- This is a workaround for the following issue https://github.com/keycloak/keycloak/issues/27117 and should be removed when the issue is fixed -->
<write-behind modification-queue-size="1024"/> <!--2-->
<!-- End of the workaround -->
<remote-server host="${env.KC_REMOTE_STORE_HOST}"
port="${env.KC_REMOTE_STORE_PORT}"/> <!--2-->
port="${env.KC_REMOTE_STORE_PORT}"/> <!--3-->
<connection-pool max-active="16"
exhausted-action="CREATE_NEW"/>
<security>
<authentication server-name="infinispan">
<digest username="${env.KC_REMOTE_STORE_USERNAME}"
password="${env.KC_REMOTE_STORE_PASSWORD}"
realm="default"/> <!--3-->
realm="default"/> <!--4-->
</authentication>
<encryption protocol="TLSv1.3"
sni-hostname="${env.KC_REMOTE_STORE_HOST}">
<truststore filename="/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
type="pem"/> <!--4-->
type="pem"/> <!--5-->
</encryption>
</security>
</remote-store>