memcached failover

[Andrew Morgan]

On Mon, 15 Aug 2016, Paul B. Henson wrote:

>> From: Cantor, Scott
>> Sent: Wednesday, August 10, 2016 7:34 PM
>>
>> I don't know anything about Hazelcast, but if it works that well,
>> probably the best option would be if JJ were willing to put it into a
>> donateable form and be willing to act as a backstop supporting it if we
>> included it in 3.3.
>>
>> I'm willing to spend a little time reviewing what it's doing to see if
>> it's taking any shortcuts I would be uncomfortable with.
>
> I can't speak for Unicon or JJ, but personally I think that's a great 
> idea :). I used their hazelcast ticket registry with CAS for a number of 
> years and it worked very well, so far their hazelcast storage backend 
> for the idp has been working just as well.
>
> It's pure Java, which is nice in that you don't need to set up and 
> deploy any extra pieces or components. It also seems to be very reliable 
> and fault-tolerant, which is a good feature for a clustering backend. 
> The only piece missing is that the free version doesn't support over the 
> wire encryption between the cluster members; I work around that by using 
> transport level encryption via IPsec tunnels. I think most of the people 
> doing clustering aren't using encryption anyway and are just trusting 
> their data center networks to be secure.
>
> It would be really useful for the IDP to support easy to set up shared 
> state clustering out of the box, particularly for people that want to 
> use the CAS protocol support.

I was looking into using Hazelcast as well, but then I noticed this 
comment about Hazelcast software upgrades at:

   https://hazelcast.org/deployment-operations-guide/#hazelcast-software-updates

"From version 3.6, Hazelcast supports updating clients with different 
minor versions. For example, Hazelcast 3.6.x clients will work with 
Hazelcast version 3.7.x. However, major and minor version updates of 
cluster members must be performed concurrently which will require 
scheduled a maintenance window to bring the cluster down. Only patch-level 
updates are supported on members of a running cluster (i.e., rolling 
upgrade)."

So...  are you guys planning to take down your authentication service in 
order to perform a Hazelcast upgrade?  Or is there something I'm missing? 
This seems like a pretty major problem...

Thanks,
 	Andy