Curity has an internal Distributed Service which is used to implement certain features that require communication between different Curity nodes in a Cluster.
This service is mostly independent of the clustering configuration used by the Configuration Service (see notes below about the cluster key), but can only be configured if the Configuration Service cluster is also configured.
For the Distributed Service to work, it is important that all nodes are able to connect to each other using the TCP protocol. By default, port 6790 is used, but that can be configured.
6790
Note
Currently, the Distributed Service is still experimental and its configuration and implementation are expected to change. For this reason, we do not recommend explicitly configuring the distributed-service-port (inside the Cluster configuration), which defaults to 6790.
distributed-service-port
When a cluster node starts up, it will immediately connect to the Admin node (as configured for the Configuration cluster) using the hostname configured for it. The Admin node does not initiate communication with other nodes. Each Runtime node sends its own hostname to Admin, which then informs all other nodes about which nodes are part of the cluster.
A node finds its own hostname or IP address by inspecting the available networks interfaces and choosing the first non-loopback network interface available.
If it does not find a suitable one, the node reads the HOST environment variable, which is set automatically in many deployments. If that is not set, 0.0.0.0 is used, which cannot work on real deployments but may be sufficient for testing purposes. Before going to production, ensure that the nodes are able to find their own addresses and report that correctly.
HOST
0.0.0.0
While it is not advisable, it is possible to disable the Distributed Service completely by setting the environment variable se.curity.distributed-service.enable to false. In the future, doing this may break important functionality of the Curity Identity Server, but currently only affects Admin UI functionality to display metrics about individual cluster nodes.
se.curity.distributed-service.enable
false
The Distributed Service uses the Configuration Service Cluster configuration’s keystore to establish mutual TLS communication between nodes. Hence, communication is both encrypted and authenticated. Regardless, it is not advisable to expose the Distributed Service to the outside world unnecessarily (after all, its only purpose is to allow Curity nodes to communicate with each other).