Keycloak 10.0.0 in a Kubernets Cluster - random issues

Configuring the server
1

Hello,
I have two problems with Keycloak in a Kubernets cluster. We have 6 pods from Keycloak witch have a connection to a DB cluster.

We configure for user custom attributes. We mapping a few attributes to the client (we write the Attributes in the Token and the InfoUser).
In the Database i can see the Attributes, but we get not in all Token-Request or UserInfo-Request this attribute´s. We get or get not this - randomly and i can’t say why. All Keycloaks use the same database.

The other thing is, that the Keycloak Pod has sometimes Failure like this:

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.sun.mail.util.SocketFetcher     
(jar:file:/opt/jboss/keycloak/modules/system/layers/base/javax/mail/api/main/jakarta.mail-1.6.4.jar!/) 
to method sun.security.util.HostnameChecker.getInstance(byte)
WARNING: Please consider reporting this to the maintainers of com.sun.mail.util.SocketFetcher
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access 
operations
WARNING: All illegal access operations will be denied in a future release

or

WARN [org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory] (ConnectionValidator)  
IJ030027: Destroying connection that is not valid, due to the following exception:  
org.mariadb.jdbc.MariaDbConnection@5ab3dd35: java.sql.SQLNonTransientConnectionException: 
(conn=8011472) unexpected end of stream, read 0 bytes from 4 (socket was closed by server)
at org.mariadb.jdbc//org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.get(ExceptionMapper.java:241)

at
org.mariadb.jdbc//org.mariadb.jdbc.internal.util.exceptions.ExceptionMapper.getException(ExceptionMapper.java:164)
at org.mariadb.jdbc//org.mariadb.jdbc.MariaDbStatement.executeExceptionEpilogue(MariaDbStatement.java:258)

2

Your Keycloak instances not only have to use the same DB (obviously!), but they also have to run in clustered mode. Do they build a cluster? Do they recognize each other?

Further information:
https://www.keycloak.org/docs/latest/server_installation/index.html#_clustering
https://www.keycloak.org/2019/05/keycloak-cluster-setup
https://www.keycloak.org/2019/08/keycloak-jdbc-ping
(besides JDBC_Ping, there’s also a KUBE_Ping available)

3

Hey,

yes the Server use the same database, while i have only this database.

I follow the tut from https://www.keycloak.org/2019/08/keycloak-jdbc-ping to configure this cluster. I can add with rancher a new pod and can see in the logs that´s the server read the other nodes out from the database and sync the sessions, token´s and something else.

But now, I saw the mariadb errors and see that the pot´s restart often.

Was is the recommended option for Kubernets Cluster this Keycloak? JDBC_Ping or KUBE_Ping?

Thanks :slight_smile: