60 lines
2.3 KiB
Markdown
60 lines
2.3 KiB
Markdown
# Keycloak cluster of the S2I2S project
|
|
|
|
Two VMs, `m1.medium` (RAM 4 - VCPUs 2), Ubuntu 24.04, 30 GB of root disk, no
|
|
data volume, in a server group with the **hard** anti affinity policy
|
|
(`anti-affinity`: the scheduler fails instead of putting the two instances on
|
|
the same hypervisor).
|
|
|
|
Each instance has **two interfaces**:
|
|
|
|
| Interface | Address | Use |
|
|
|---|---|---|
|
|
| main private network | `10.10.0.163`, `10.10.0.164` | traffic from the L7 HAPROXY load balancers and from Prometheus, administration |
|
|
| `postgresql-srv-net` | from the DHCP pool | the only way to the database |
|
|
|
|
Security groups:
|
|
|
|
* `keycloak_cluster_traffic` — TCP, UDP and IGMP between the two nodes
|
|
(Infinispan/JGroups). The rules use the static addresses of the instances, so
|
|
they do not depend on the instances being created first;
|
|
* `traffic_to_keycloak_from_the_main_load_balancers` — ingress on 9443 from each
|
|
HAPROXY L7, and on 9000 (management and metrics) from the load balancers and
|
|
from Prometheus;
|
|
* `vm_access_to_the_postgresql_service` — taken from the `postgresql` workspace,
|
|
on the port in the dedicated network of the database.
|
|
|
|
A CNAME `accounts.s2i2s.cloud.isti.cnr.it` pointing to the main load balancer is
|
|
created; the service itself is published by the HAPROXY L7 configuration (see
|
|
`docs/main_load_balancer.md` in `infrastructure-playbooks`, variable
|
|
`haproxy_l7_services`).
|
|
|
|
The resources and the sizing are in
|
|
[`../../modules/keycloak`](../../modules/keycloak), as defaults of
|
|
`keycloak_data`: override them in the module call to change them. The addresses
|
|
of the instances come from the address plan in [`../variables`](../variables)
|
|
(`basic_services_ip.keycloak_1` and `_2`, exported as the `keycloak_ip` list).
|
|
|
|
## Order of the applies
|
|
|
|
```
|
|
main_net_dns_router -> project-setup -> postgresql -> keycloak
|
|
```
|
|
|
|
This workspace reads the state of all three: the network and the DNS zone, the
|
|
default security group and the addresses of the load balancers and of
|
|
Prometheus, and the dedicated network of the database with its client security
|
|
group.
|
|
|
|
```bash
|
|
tofu init
|
|
tofu plan -out=keycloak.plan
|
|
tofu apply keycloak.plan
|
|
```
|
|
|
|
After the apply, regenerate the ansible inventory in
|
|
`infrastructure-playbooks`, which reads this state:
|
|
|
|
```bash
|
|
ansible-playbook tofu-inventory.yml --diff
|
|
```
|