Feedback about kubernetes/FUSIONAUTH_APP_URL configuration

[mooreds]

Feedback about kubernetes/FUSIONAUTH_APP_URL configuration

Description

From a user interview:

We struggle a bit to run multiple FusionAuth instances in Kubernetes. We usually have more than one replica of each service and to do this in Kubernetes we normally only need to indicate the number of replicas we want.

But with FusionAuth this can’t be done because each replica needs to know its URL through the FUSIONAUTH_APP_URL environment variable.

To work around this issue and have at least two replicas of FusionAuth we need to create two separate deployments, each with just one replica, and then create a service pointing to these two deployments.

Need to get more clarity about this.

[mooreds]

@johnmaia we are looking further into this issue. Can you provide any more details about this?

• versions of kubernetes
• replication steps
• network architecture
• symptoms/issues
• anything else you can provide

Thanks!

[ceefour]

I'm just continuing what the user described. From my POV the request is pretty clear.

Deployment e.g. deployment/fusionauth

it has a spec.replicas: 2 and needs to provide environment FUSIONAUTH_APP_URL
e.g.

environment:
  - name: FUSIONAUTH_APP_URL
     value: https://sso.example.com

The problem now is that you'll have a replica set with two pods, and both pods use the exact name environment variable including the FUSIONAUTH_APP_URL.

Is this intended or not?

[mooreds]

hi @ceefour !

So the app url is not the public facing URL value (like sso.example.com) but rather the way to address each individual node.

From https://fusionauth.io/docs/v1/tech/reference/configuration

The FusionAuth App URL that is used to communicate with other FusionAuth nodes. This value is defaulted if not specified to use a localhost address or a site local if available. Unless you have multiple FusionAuth nodes the generated value should always work. You may need to manually specify this value if you have multiple FusionAuth nodes and the only way the nodes can communicate is on a public network.

So the first thing I'd do would be see if things work without specifying the env var. That should work (you can't set the app URL variable in our charts: https://github.com/FusionAuth/charts and I know folks are running in prod with that).

If that doesn't work, then there might be a different issue worth diving into.

Hope this helps.