Deprecation legacy observability interface #37287
Replies: 4 comments 1 reply
-
|
@vvchistyakov it's clear that you are saying end clients cannot access /health and /metrics, but it's not clear on how those are being used underneath by the ALB / EC2 - can you elaborate on that? |
Beta Was this translation helpful? Give feedback.
-
|
I am facing a similar issue while upgrading Keycloak to 26. The only option I could go with was to enable KC_LEGACY_OBSERVABILITY_INTERFACE. I don't know if there is a better way of implementing this but it seems like its our only option for now. |
Beta Was this translation helpful? Give feedback.
-
|
@vvchistyakov @abhishek-shrivastava-netspi please see #39506 - until something like that is an option you will have to use KC_LEGACY_OBSERVABILITY_INTERFACE |
Beta Was this translation helpful? Give feedback.
-
|
I'm facing the same problem in Google Cloud. I'm dependent on setting |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello there,
I would like to rice a discussion about deprecation of legacy observability interface (
KC_LEGACY_OBSERVABILITY_INTERFACE=true). I saw that this parameter was marked as deprecated in docs.We use AWS ECS Service with ECS
bridgenetwork + ALB with a targets group. Thebridgenetwork is mapping Container ports on EC2 instance ports dynamically. To map ALB (target group) port on a ECS task port like 8080, we set up the container port (8080), container name, arn of a target group on ECS Service configuration. It allows us to create a flow:Client -> ALB (443 port) -> Target group -> EC2 instance (dynamic port) -> ECS task -> Keycloak Container (8080 port)
ECS service makes all mapping magic behind of the scene. However, the target group makes health-check in all targets associated with it. To simplify everything, there is the magic in the configuration. We define
traffic-portas a port health-check. And, the target-group uses allocated dynamic port for each target. There is another option to specify any port. But this port is a constant port, and we can't associate it with dynamically mapped port for management (9000 container port). In this case for us, the best way is to keep health-check on the main (8080) port. Yes we understand that it is an insecure option. However, we block /health /metric endpoints on the ALB side for our clients. And we are good again there =)I understand that the main supporting tool for you is a Kubernets, but we don't see a migration from ECS to there in the nearest future.
So, could you please to continue support
KC_LEGACY_OBSERVABILITY_INTERFACEoption? Do you have an alternative for it?Thank you.
Beta Was this translation helpful? Give feedback.
All reactions