I have a Kubernetes cluster where I deployed the following deployment and service:
apiVersion: v1
kind: Service
metadata:
name: keycloak
labels:
app: keycloak
name: keycloak
spec:
type: NodePort
ports:
- name: http
protocol: TCP
port: 8080
selector:
app: keycloak
name: keycloak
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: keycloak
labels:
name: keycloak
app: keycloak
spec:
replicas: 1
selector:
matchLabels:
app: keycloak
template:
metadata:
name: keycloak
labels:
app: keycloak
name: keycloak
spec:
restartPolicy: Always
containers:
- name: keycloak
image: jboss/keycloak
ports:
- containerPort: 8080
protocol: TCP
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: 400m
memory: 512Mi
env:
- name: KEYCLOAK_LOGLEVEL
value: "DEBUG"
- name: PROXY_ADDRESS_FORWARDING
value: "true"
- name: KEYCLOAK_USER
value: "admin"
- name: KEYCLOAK_PASSWORD
value: "password"
- name: DB_USER
valueFrom:
secretKeyRef:
name: postgres-secret
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: postgres-secret
key: password
- name: DB_ADDR
valueFrom:
configMapKeyRef:
name: postgres-configmap
key: HOST
- name: DB_PORT
valueFrom:
configMapKeyRef:
name: postgres-configmap
key: PORT
- name: DB_DATABASE
valueFrom:
configMapKeyRef:
name: postgres-configmap
key: DATABASE
- name: DB_VENDOR
value: "postgres"
The logs in my pod where keycloak is running are confirming that my keycloak is running and using the Postgres database that is provided. I try to add the following ingress rules:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: keycloak
annotations:
kubernetes.io/tls-acme: "true"
kubernetes.io/ingress.class: "nginx"
ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
rules:
- host: auth.mydomain.com
http:
paths:
- path: /
backend:
serviceName: keycloak
servicePort: 8080
- path: /auth
backend:
serviceName: keycloak
servicePort: 8080
and I am able to get to the Keycloak home page, but once I click on administration console I keep getting the error: We're sorry .... HTTPS required
. Setting the PROXY_ADDRESS_FORWARDING variable to "true", did not help to get it right. I don't just want to run keycloak on port 8443, so I am really looking for another solution than that.
You need to setup TLS termination within your ingress
spec:
tls:
- hosts:
- auth.mydomain.com
secretName: tls-secret
With created secret, which contains certificate for auth.mydomain.com
:
apiVersion: v1
kind: Secret
metadata:
name: tls-secret
namespace: default
type: kubernetes.io/tls
data:
tls.crt:LS0S[...]0tLhsrQo=
tls.key:LS0t[...]LS1CRUdJ=
This will let your ingress controller to terminate traffic using provided TLS cert, and forward un-encrypted HTTP traffic to your keycloak
service.