Utilise `jdbc-ping` TCP based JGroups stack as default for non-operator Keycloak deployments

[ryanemerson]

Description

Currently Keycloak defaults to using a UDP based stack if no "cache-stack" is explicitly configured. However, when Keycloak is deployed via the operator the "kubernetes" stack is used which is based upon TCP. As some cloud environments don't support UDP, and in order to align with Operator deployments, we should default to using TCP.

#34265 Introduced the jdbc-ping-udp and jdbc-ping stacks. From 26.1 onwards, the default stack is jdbc-ping-udp as it was not possible to transition the default from TCP to UDP as it may have caused breaking changes to users firewall configurations.

Starting in Keycloak 27.0, we should change the default stack to be jdbc-ping so that it is TCP based.

Discussion

No response

Motivation

No response

Details

No response

[ahus1]

Thank you for opening the issue. As we are in the space of minor release, I wonder if we would combine it in a way "if you enable JDBC_PING we would also switch over to TCP at the same time". Let's have a discussion here or in our next team call if those should be separate, or independent.

[ahus1]

Thinking about it a bit more, I think UDP vs TCP makes a difference for people's network configurations, therefore we might then need jdbc-ping-udp which is the default and non-breaking with the 26 release cycle, and jdbc-ping-tcp which can then replace the ec2, google and the azure stacks (which all use TCP).

[ahus1]

@stianst - can you please comment if switching from UDP to TCP by default would be a breaking change for people? I'd say yes as it would affect firewall rules. Please let me know if there is an alternative.

[ryanemerson]

After further discussion, we believe that changing from UDP to TCP is a breaking change for a minor release as it may require firewall changes. Our proposal is to do the following:

• Introduce two JDBC_PING based stacks: jdbc-ping-udp and jdbc-ping (TCP based) and set jdbc-ping-udp as the default stack for 26.1 Add JDBC_PING2 stacks for both TCP and UDP #34265
• jdbc-ping is the replacement for the [ec2,google,azure] stacks which will be deprecated in Deprecate other transport stacks (ec2, azure, google) #34253
• Make jdbc-ping the default in 27

[ahus1]

We now realized that the behavior in KC26 for JGroups is using TCP and UDP random ports, so that using just TCP is a drop-in replacement and jdbc-ping is now the default for KC26.1

See #34719 for the discussion and the change.