No, but you may need to configure the distributed cached Keycloak comes configured with.
Out of the box in the default configuration, with no intervention needed, N instances of Keycloak running on (virtual or physical) machines on the same subnet will automagically find each other via multicast UDP and form a cluster.
In a container environment, you’ll need to help Keycloak find the other instances. Take a look at Configuring distributed caches - Keycloak.
This documentation is somewhat sparse, but the idea is that you configure a discovery mechanism and (probably want to) leave the rest to jgroups (the underlying cluster engine used by keycloak).
For kubernetes, use KC_STACK=kubernetes
, create a headless service and set a property used by jgroups (-Djgroups.dns.query=<headless-service-FQDN>
) using environment variable JAVA_OPTS_APPEND
.
So, if your namespace is my_namespace
, your headless service is called keycloak-headless
, you have:
KC_STACK=kubernetes
JAVA_OPTS_APPEND=-Djgroups.dns.query=keycloak-headless.my_namespace.svc.cluster.local
The .my_namespace.svc.cluster.local
part is optional, but included for the sake of completeness.
Please note that CLUSTERED MODE DEPENDS ON AN EXTERNAL DATABASE. Although Keycloak runs by default with an ephemeral in-memory database, to correctly run as a cluster, you’ll need an external database. It should be pretty simple. Just create a database, set the credentials and keycloak will create and populate the schema.