<#import "/templates/guide.adoc" as tmpl>
<#import "/templates/links.adoc" as links>

<@tmpl.guide
title="Deploying {project_name} for HA with the Operator"
summary="Deploy {project_name} for high availability with the {project_name} Operator as a building block."
tileVisible="false" >

This {section} describes advanced {project_name} configurations for {kubernetes} which are load tested and will recover from single Pod failures.

These instructions are intended for use with the setup described in the <@links.ha id="multi-cluster-concepts"/> {section}.
Use it together with the other building blocks outlined in the <@links.ha id="multi-cluster-building-blocks"/> {section}.

== Prerequisites

* {kubernetes} cluster running.
* Understanding of a <@links.operator id="basic-deployment" /> of {project_name} with the {project_name} Operator.
* AWS Aurora database deployed using the <@links.ha id="multi-cluster-deploy-aurora" /> {section}.
* {jdgserver_name} server deployed using the <@links.ha id="multi-cluster-deploy-infinispan-kubernetes-crossdc" /> {section}.

== Procedure

. Determine the sizing of the deployment using the <@links.ha id="multi-cluster-concepts-memory-and-cpu-sizing" /> {section}.

. Install the {project_name} Operator as described in the <@links.operator id="installation" /> {section}.

. Notice the configuration file below contains options relevant for connecting to the Aurora database from <@links.ha id="multi-cluster-deploy-aurora" anchor="multi-cluster-aurora-connecting" />

. Notice the configuration file below options relevant for connecting to the {jdgserver_name} server from <@links.ha id="multi-cluster-deploy-infinispan-kubernetes-crossdc" anchor="connecting-infinispan-to-keycloak" />

. Build a custom {project_name} image which is link:{links_server_db_url}#preparing-keycloak-for-amazon-aurora-postgresql[prepared for usage with the Amazon Aurora PostgreSQL database].

. Secure the Amazon Aurora PostgreSQL database connection by downloading the https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html[certificate bundles].
Create a `ConfigMap` with the certificate bundle using:
+
[source,bash]
----
kubectl --namespace keycloak create configmap keycloak-aurora-rootcert --from-file aurora.pem=/path/to/bundle.pem
----

. Deploy the {project_name} CR with the following values with the resource requests and limits calculated in the first step:
+
[source,yaml]
----
include::../examples/generated/keycloak.yaml[tag=keycloak]
----
<1> Secure the database connection with the `sslmode=verify-full` and `sslrootcert` properties.
<2> The database connection pool initial, max and min size should be identical to allow statement caching for the database.
Adjust this number to meet the needs of your system.
As most requests will not touch the database due to the {project_name} embedded cache, this change can serve several hundreds of requests per second.
See the <@links.ha id="multi-cluster-concepts-database-connections" /> {section} for details.
<3> Specify the URL to your custom {project_name} image. If your image is optimized, set the `startOptimized` flag to `true`.
<4> Enable additional features for multi-cluster support like the loadbalancer probe `/lb-check`.
<5> To be able to analyze the system under load, enable the metrics endpoint.
<6> Specify the `ConfigMap` name that contains the Amazon Aurora PostgreSQL database certificate bundle.
The Operator will automatic mount the file in directory `/opt/keycloak/conf/truststores/configmap-<config map name>/<file-name>`

<#include "/high-availability/partials/building-blocks/verifying-deployment.adoc" />

<#include "/high-availability/partials/building-blocks/load-shedding.adoc" />

<#include "/high-availability/partials/building-blocks/sticky-sessions.adoc" />

</@tmpl.guide>
