Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

oathkeeper-issue.json

I am running into an intermittent issue as of Keto version `v0.11.1-alpha.0` and I am still on Oathkeeper `v0.39.0`. I get an intermittent 403 forbidden on my `check` call for authorization after logging in. I am not sure exactly how to decipher these logs because it doesn't happen 100% of the time, only a few times and then everything just works. I can confirm the relation-tuples are as expected in the keto table of the postgres instance. Below are the Oathkeeper errors. I can post my Oathkeeper config if needed.

<@U011D3UQKNY>
Maybe these errors come from Keto not being ready to accept requests? I've artificially created the same issue by killing the Keto pod in the cluster and attempting to make the same query. That might also make sense if it doesn't work and then works after a couple of attempts.

I guess my next question is why would it be down in a cluster. Is it possible to scale the keto pod to have 2 available at all times with the same info?