Use this as a starting point to size a product environment. Adjust the values for your environment as needed based on your load tests.
|
Summary:
The used CPU scales linearly with the number of requests up to the tested limit below.
The used memory scales linearly with the number of active sessions up to the tested limit below.
Recommendations:
The base memory usage for an inactive Pod is 1000 MB of RAM.
For each 100,000 active user sessions, add 500 MB per Pod in a three-node cluster (tested with up to 200,000 sessions).
This assumes that each user connects to only one client. Memory requirements increase with the number of client sessions per user session (not tested yet).
In containers, Keycloak allocates 70% of the memory limit for heap based memory. It will also use approximately 300 MB of non-heap-based memory. To calculate the requested memory, use the calculation above. As memory limit, subtract the non-heap memory from the value above and divide the result by 0.7.
For each 8 password-based user logins per second, 1 vCPU per Pod in a three-node cluster (tested with up to 300 per second).
Keycloak spends most of the CPU time hashing the password provided by the user, and it is proportional to the number of hash iterations.
For each 450 client credential grants per second, 1 vCPU per Pod in a three node cluster (tested with up to 2000 per second).
Most CPU time goes into creating new TLS connections, as each client runs only a single request.
For each 350 refresh token requests per second, 1 vCPU per Pod in a three-node cluster (tested with up to 435 refresh token requests per second).
Leave 200% extra head-room for CPU usage to handle spikes in the load. This ensures a fast startup of the node, and sufficient capacity to handle failover tasks like, for example, re-balancing Infinispan caches, when one node fails. Performance of Keycloak dropped significantly when its Pods were throttled in our tests.
Target size:
50,000 active user sessions
24 logins per seconds
450 client credential grants per second
350 refresh token requests per second
Limits calculated:
CPU requested: 5 vCPU
(24 logins per second = 3 vCPU, 450 client credential grants per second = 1 vCPU, 350 refresh token = 1 vCPU)
CPU limit: 15 vCPU
(Allow for three times the CPU requested to handle peaks, startups and failover tasks)
Memory requested: 1250 MB
(1000 MB base memory plus 250 MB RAM for 50,000 active sessions)
Memory limit: 1360 MB
(1250 MB expected memory usage minus 300 non-heap-usage, divided by 0.7)
The following setup was used to retrieve the settings above to run tests of about 10 minutes for different scenarios:
OpenShift 4.14.x deployed on AWS via ROSA.
Machinepool with m5.4xlarge
instances.
Keycloak deployed with the Operator and 3 pods in a high-availability setup with two sites in active/passive mode.
OpenShift’s reverse proxy running in passthrough mode were the TLS connection of the client is terminated at the Pod.
Database Amazon Aurora PostgreSQL in a multi-AZ setup, with the writer instance in the availability zone of the primary site.
Default user password hashing with PBKDF2(SHA512) 210,000 hash iterations which is the default as recommended by OWASP.
Client credential grants don’t use refresh tokens (which is the default).
Database seeded with 20,000 users and 20,000 clients.
Infinispan local caches at default of 10,000 entries, so not all clients and users fit into the cache, and some requests will need to fetch the data from the database.
All sessions in distributed caches as per default, with two owners per entries, allowing one failing Pod without losing data.