openstack-infrastructure-terraform/s2i2s/keycloak

Keycloak cluster of the S2I2S project

Two VMs, m1.medium (RAM 4 - VCPUs 2), Ubuntu 24.04, 30 GB of root disk, no data volume, in a server group with the hard anti affinity policy (anti-affinity: the scheduler fails instead of putting the two instances on the same hypervisor).

Each instance has two interfaces:

Interface	Address	Use
main private network	10.10.0.163, 10.10.0.164	traffic from the L7 HAPROXY load balancers and from Prometheus, administration
postgresql-srv-net	from the DHCP pool	the only way to the database

Security groups:

• keycloak_cluster_traffic — TCP, UDP and IGMP between the two nodes (Infinispan/JGroups). The rules use the static addresses of the instances, so they do not depend on the instances being created first;
• traffic_to_keycloak_from_the_main_load_balancers — ingress on 9443 from each HAPROXY L7, and on 9000 (management and metrics) from the load balancers and from Prometheus;
• vm_access_to_the_postgresql_service — taken from the postgresql workspace, on the port in the dedicated network of the database.

A CNAME accounts.s2i2s.cloud.isti.cnr.it pointing to the main load balancer is created; the service itself is published by the HAPROXY L7 configuration (see docs/main_load_balancer.md in infrastructure-playbooks, variable haproxy_l7_services).

The resources and the sizing are in ../../modules/keycloak, as defaults of keycloak_data: override them in the module call to change them. The addresses of the instances come from the address plan in ../variables (basic_services_ip.keycloak_1 and _2, exported as the keycloak_ip list).

Order of the applies

main_net_dns_router  ->  project-setup  ->  postgresql  ->  keycloak

This workspace reads the state of all three: the network and the DNS zone, the default security group and the addresses of the load balancers and of Prometheus, and the dedicated network of the database with its client security group.

tofu init
tofu plan -out=keycloak.plan
tofu apply keycloak.plan

After the apply, regenerate the ansible inventory in infrastructure-playbooks, which reads this state:

ansible-playbook tofu-inventory.yml --diff