Repository navigation
Conversation
|
@pedroigor / @vmuzikar - this PR adds load shedding to Keycloak with RESTEasy reactive. Compared to the previous attempt to limit the blocking thread pool of Quarkus, this will limit all requests, even those which are reactive. In contrast to the previous attempt, it now allows to exclude the health endpoints and the metrics, so they will never return a 503 due to load shedding. Instead of using the Quarkus parameter to setting the max queue length for blocking requests, it defines the maximum number of active requests which IMHO is better as it hides the internals of the Keycloak and makes this more approachable for customers. I still marked it as "preview" in the options. The same approach could be backported for KC22 if you would agree on that. Please let me know your thoughts. |
Unreported flaky test detectedIf the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.webauthn.account.WebAuthnTransportLocaleTest#localizationTransportNFCKeycloak CI - WebAuthn IT (chrome) |
There was a problem hiding this comment.
Unreported flaky test detected, please review
There was a problem hiding this comment.
If the idea is to provide a best effort (not 100% accurate) about the number and a better output in logs, I would avoid using synchronized here. This code runs in an event loop thread if we can avoid blocking at all costs, better.
All that to say I'm not sure about introducing synchronization for logging purposes ...
What if expose these statistics as a metric and potentially introduce a health check for it too?
There was a problem hiding this comment.
I've moved the logging out of the block. I'd like to add metrics in a second iteration. Waiting for the builds to complete, will then mark it ready-for-review.
e696454 to
cc78a45
Compare
|
I've created a Quarkus feature request to support this based on the PR: #36543 |
There was a problem hiding this comment.
Unreported flaky test detected, please review
Unreported flaky test detectedIf the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithCRLSignedWithIntermediateCA3FromTruststoreKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithInvalidSignatureCRLKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithRevocationListFromDistributionPointsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsUsingInvalidCertKeycloak CI - FIPS IT (non-strict) |
Unreported flaky test detectedIf the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithCRLSignedWithIntermediateCA3FromTruststoreKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithInvalidSignatureCRLKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithRevocationListFromDistributionPointsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsUsingInvalidCertKeycloak CI - FIPS IT (non-strict) |
There was a problem hiding this comment.
Unreported flaky test detected, please review
There was a problem hiding this comment.
Unreported flaky test detected, please review
Unreported flaky test detectedIf the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithCRLSignedWithIntermediateCA3FromTruststoreKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithIntermediateRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithInvalidSignatureCRLKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromFileKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginSuccessWithEmptyRevocationListFromHttpKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginFailedWithRevocationListFromDistributionPointsKeycloak CI - FIPS IT (non-strict) org.keycloak.testsuite.x509.X509BrowserCRLTest#loginWithMultipleRevocationListsUsingInvalidCertKeycloak CI - FIPS IT (non-strict) |
There was a problem hiding this comment.
I think we should resurrect this PR for the upcoming 23. :)
@pedroigor Do you want to give it another look?
70dda05 to
055bf69
Compare
There was a problem hiding this comment.
Unreported flaky test detected, please review
Unreported flaky test detectedIf the below flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#createClient |
Closes keycloak#23340 Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
055bf69 to
9de050f
Compare
There was a problem hiding this comment.
@ahus1 Thanks for the update. LGTM but I'd like a green tick from @pedroigor as well before merging this.
|
After discussing this with the Quarkus team a bit more, it turned out this is actually a bug in Quarkus: quarkusio/quarkus#36860. We might want to reconsider introducing this to Keycloak after all. |
|
@vmuzikar - yes, I agree. Still a bit sad 😢 that we can't distinguish between URLs when doing the load shedding. |
Closes #23340