On this page
Context and Problem Statement
keycloak must provide resilient smart access across clusters. We need to choose a deployment model that meets availability, scale, and operational requirements while remaining manageable in automation workflows.
Scope boundary: this ADR covers IAM architecture (identity domains, integration posture, and operational model). Detailed SSO deployment topology and failover options remain in ADR-012.
Decision Drivers
- Resilience to single-node and single-datacenter failures.
- Capacity for peak load across all integrated applications.
- Ability to scale Keycloak and cache layers independently when needed.
Considered Options
- Multiple Keycloak clusters with active/passive replication across datacenters.
- Multiple Keycloak clusters without cross-site replication, with failover automation.
Decision Outcome
Decision remains draft. Both models remain under evaluation for operational complexity, failover behavior, and scalability.
Next Decision Trigger
- Decision owner: Platform Architecture with Security Architecture review.
- Promote to
acceptedwhen identity domain design, failover behavior, and scaling test evidence are approved. - If neither model satisfies operational objectives, add a third option with explicit trade-offs before 2026-03-15.
Pros and Cons of the Options
Option 1 – Replicated clusters with active/passive failover
Pros
- Predictable failover with shared state between datacenters.
Cons
- Complex replication and cache configuration.
Option 2 – Independent clusters with failover automation
Pros
- Simpler per-site operation and isolation.
Cons
- Requires automated activation and potential user-impact during failover.