I'm trying to setup ProxyInjector to automatically inject keycloak-gateway into any container that has annotations like the following I have for a service I'm deploying on kubernetes:

"annotations": {
  "authproxy.stakater.com/client-id": "bitwarden",
  "authproxy.stakater.com/client-secret": "<secret>",
  "authproxy.stakater.com/discovery-url": "https://keycloak.example.com/auth/realms/realmname",
  "authproxy.stakater.com/enabled": "true",
  "authproxy.stakater.com/listen": "127.0.0.1:3000",
  "authproxy.stakater.com/redirection-url": "http://127.0.0.1:3000",
  "authproxy.stakater.com/source-service-name": "bitwarden",
  "authproxy.stakater.com/target-port": "3000",
  "authproxy.stakater.com/upstream-url": "http://127.0.0.1:80",
}

This is for a bitwardenrs deployment in Kubernetes. The service is as follows:

---
kind: Service
apiVersion: v1
metadata:
  name: bitwarden
spec:
  selector:
    app: bitwarden
  ports:
    - protocol: TCP
      name: bitwarden-http
      port: 80
      targetPort: 80
    - protocol: TCP
      name: bitwarden-https
      port: 443
      targetPort: 443
  type: NodePort

I can access the service normally through ingress. But when I add the annotations to authenticate in front of it, I get a 502 bad gateway error.

Checking the bitwarden pod logs, I can see the proxy container successfully starts up and proxying according to what I defined here. But I don't see any logs about it actually attempting to proxy anything (either in that pod, or my ingress-controller pod).

Am I doing something wrong for it to be returning a 502?