Added a guide to deploy on bare-metal/VMs - #51085
Merged
ahus1 merged 6 commits intoJul 27, 2026
Merged
Conversation
Closes keycloak#50840 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a bare-metal/VM deployment blueprint for stateless multi-cluster HA and links it into the existing documentation flow.
Changes:
- Adds deployment prerequisites, topology, configuration, and verification steps.
- Links and pins the new blueprint.
- Note: the referenced issue concerns LDAP metrics and does not match this PR.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
pinned-guides |
Registers the new guide. |
introduction.adoc |
Links the bare-metal blueprint. |
deploy-keycloak-bare-metal.adoc |
Adds the deployment guide. |
concepts.adoc |
Adds the guide as a next step. |
Closes keycloak#50921 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
Comments suppressed due to low confidence (1)
docs/guides/high-availability/multi-cluster-v2/deploy-keycloak-bare-metal.adoc:122
- This enables trust in unsigned PROXY headers without requiring the application port to be restricted to trusted load balancers. As
server/reverseproxy.adoc:87-89notes, direct access otherwise lets clients spoof source IPs; add the network restriction to this deployment procedure.
The load balancer must also be configured to send PROXY protocol headers (for example, `send-proxy-v2` in HAProxy).
Closes keycloak#50921 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
docs/guides/high-availability/multi-cluster-v2/deploy-keycloak-bare-metal.adoc:71
- Typing the password in an
exportcommand normally records the literal secret in shell history, contradicting the stated protection. Read it interactively without echo (or use a protected service-manager environment/credential file) before exporting it.
export KC_DB_USERNAME=<DB_USERNAME>
export KC_DB_PASSWORD=<DB_PASSWORD>
Closes keycloak#50921 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
ryanemerson
reviewed
Jul 22, 2026
Closes keycloak#50921 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Contributor
Author
|
Hello @ryanemerson, Thanks for the review !!All previous comments are now resolved. Could you please re-review the PR if any other changes are needed? |
ahus1
requested changes
Jul 23, 2026
ahus1
left a comment
Member
There was a problem hiding this comment.
Thank you for the PR, it looks good.
See below for some review comments that should be addressed before merging this one.
Closes keycloak#50921 Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
ahus1
approved these changes
Jul 27, 2026
ahus1
marked this pull request as ready for review
July 27, 2026 12:34
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
docs/guides/high-availability/multi-cluster-v2/deploy-keycloak-bare-metal.adoc:105
- For the documented global-to-per-site load-balancer chain, configuring only the Keycloak-facing proxy to emit PROXY headers does not guarantee that Keycloak receives the original client address. Document that the global hop must preserve/forward the client address and that the per-site hop must accept and re-emit it; otherwise audit logs may contain the global load balancer's address instead.
<8> Enable the PROXY protocol so that {project_name} can read the real client IP address from the PROXY protocol header sent by the load balancer.
To use this option, the load balancer must also be configured to send PROXY protocol headers (for example, `send-proxy-v2` in HAProxy).
If your load balancer does not support the PROXY protocol, remove this option to use plain HTTPS.
Comment on lines
+39
to
+40
| This topology is simpler to manage. | ||
| Per-site operational tasks such as draining a site for maintenance or isolating a failing site require reconfiguring a shared component, which increases operational risk. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a guide to show to deploy on bare-meteal/VMs
Closes #50921