Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: account for keycloak HA ports #619

Merged
merged 16 commits into from
Aug 1, 2024
Merged

fix: account for keycloak HA ports #619

merged 16 commits into from
Aug 1, 2024

Conversation

rjferguson21
Copy link
Contributor

@rjferguson21 rjferguson21 commented Jul 31, 2024

Description

Fixes a number of issues to fix support Keycloak for HA deployments

  • scopes AuthorizationPolicy to port 8080 (http) to avoid denying JGroups traffic
  • adds 7800 and 57800 to headless service and pod to ensure Istio routes traffic correctly.
  • adds network policy to allow internamespace traffic on 7800 + 57800

Note: It was not immediately obvious that port 57800 is used by Keycloak's HA deployment. I noticed traffic on 57800 when debugging and did some research and determined it was related to used for Infinispan's "failure discovery protocol". The number is computed based on the port offset, so port offset (50000) + 7800 = 57800.

Related Issue

Fixes #620

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Checklist before merging

Copy link
Contributor

github-actions bot commented Jul 31, 2024

Compliance registry1 Evaluation: success

CC: @defenseunicorns/lula-dev

Copy link
Contributor

github-actions bot commented Jul 31, 2024

Compliance unicorn Evaluation: success

CC: @defenseunicorns/lula-dev

Copy link
Contributor

github-actions bot commented Jul 31, 2024

Compliance upstream Evaluation: success

CC: @defenseunicorns/lula-dev

@rjferguson21 rjferguson21 marked this pull request as ready for review July 31, 2024 16:59
mjnagel
mjnagel previously approved these changes Aug 1, 2024
Copy link
Contributor

@mjnagel mjnagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - validated with an HA setup that I did not see any session issues and all traffic appears to be working between replicas.

@rjferguson21 rjferguson21 merged commit 434f349 into main Aug 1, 2024
23 checks passed
@rjferguson21 rjferguson21 deleted the keycloak-ha-fixes branch August 1, 2024 23:02
mjnagel pushed a commit that referenced this pull request Aug 2, 2024
🤖 I have created a release *beep* *boop*
---


##
[0.25.0](v0.24.1...v0.25.0)
(2024-08-02)


### ⚠ BREAKING CHANGES

* change metric server to optional
(#611)

### Features

* add json logging for keycloak
([#610](#610))
([29ed934](29ed934))
* **istio:** add configurable TLS version
([#624](#624))
([cd2b87e](cd2b87e))


### Bug Fixes

* account for keycloak HA ports
([#619](#619))
([434f349](434f349))
* add google saml to slim-dev
([#613](#613))
([f2164e1](f2164e1))
* address network policy generation inter-namespace bug
([#564](#564))
([9b14c2c](9b14c2c))
* reference root scope
([#633](#633))
([5de6915](5de6915))


### Miscellaneous

* change metric server to optional
(#611)
([bc2d673](bc2d673))
* **deps:** update dependency defenseunicorns/uds-common to v0.9.0
([#592](#592))
([44ea2d7](44ea2d7))
* **deps:** update dependency weaveworks/eksctl to v0.187.0
([#539](#539))
([9002a94](9002a94))
* **deps:** update githubactions
([#553](#553))
([2a9e29a](2a9e29a))
* **deps:** update grafana curl image to v8.9.0
([#596](#596))
([64f9408](64f9408))
* **deps:** update grafana helm chart to v8.3.6
([#594](#594))
([1f2005b](1f2005b))
* **deps:** update istio to v1.22.3
([#580](#580))
([7aba89e](7aba89e))
* **deps:** update lula to v0.4.4
([#615](#615))
([b02b305](b02b305))
* **deps:** update neuvector-updater/curl to v8.9.0
([#597](#597))
([b4bd660](b4bd660))
* **deps:** update promtail configmap-reload to v0.13.1
([#608](#608))
([d98bbae](d98bbae))
* **deps:** update promtail helm chart to v6.16.4
([#574](#574))
([bf9f65c](bf9f65c))
* **deps:** update to identity-config 0.5.2
([#635](#635))
([6474d16](6474d16))
* **deps:** update uds cli to v0.13.1
([#569](#569))
([4339c89](4339c89))
* **deps:** update zarf to v0.36.1
([#562](#562))
([058cfb3](058cfb3))
* disable telemetry/analytics for loki/grafana
([#601](#601))
([ad785bc](ad785bc))
* update zarf to new repo location, 0.37.0
([#631](#631))
([29f9fd0](29f9fd0))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Keycloak HA ports are not routed
2 participants