K8s Nginx Ingress #19380

sonic-sw · 2023-03-28T11:35:34Z

sonic-sw
Mar 28, 2023

Dear community,

after hours of trying my self, I have to consult you for help.
I manage to run KC in production mode only when I terminate the SSL at the KC server in bypass mode in my nginx ingress config.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-auth
  namespace: auth
  annotations:
    kubernetes.io/ingress.class: "nginx"
    **nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"**
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Forwarded "for=$http_cf_connecting_ip";
      proxy_set_header X-Forwarded-For "$http_cf_connecting_ip";
spec:
  tls:
    - secretName: ingress-ssl
      hosts:
        - kc.example.com
  rules:
    - host: kc.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: keycloak-service
                port:
                  name: https

As I run CloudFlare on top of it, I had to copy the

proxy_set_header Forwarded "for=$http_cf_connecting_ip";
proxy_set_header X-Forwarded-For "$http_cf_connecting_ip";

fields into the KC used fields. It would be helpful if maybe the CF-Connecting-IP would be by default be used by KC as I would assume CloudFlare is used in many projects, but this is a different topic.

This are my ENVs for KC:

apiVersion: v1
kind: ConfigMap
metadata:
  name: keycloak-config
  namespace: auth
data:
  KC_HOSTNAME_URL: https://kc.example.com
  
  KC_PROXY: edge
  KC_HOSTNAME_STRICT_HTTPS: "false"
  KC_HOSTNAME_STRICT: "false"
  KC_HOSTNAME_STRICT_BACKCHANNEL: "false"
  KC_HTTP_ENABLED: "true"

  KC_LOG_LEVEL: info
      
  KC_HTTPS_CERTIFICATE_FILE: /etc/ssl/certs/cert.pem
  KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/ssl/certs/key.pem

What am I doing wrong in order to be able to remove the

nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS

from my nginx ingress and connect internally on the http-service-port to KC? If I remove the two lines I can the the KC landing page but when I try to navigate to the admin interface, the page constantly loads and I have a 403 error...

All my internal services later will also call KC on kc-service.auth. Will I get here also issues?

sonic-sw · 2023-03-28T16:47:31Z

sonic-sw
Mar 28, 2023
Author

I am one step closer thanks to
#14666 (comment)
After adding additional the admin-url even it is the same the admin-console loads.

KC_HOSTNAME_URL: https://kc.example.com
KC_HOSTNAME_ADMIN_URL: https://kc.example.com

KC_PROXY: edge
KC_HOSTNAME_STRICT_HTTPS: "false"
KC_HOSTNAME_STRICT: "false"
KC_HOSTNAME_STRICT_BACKCHANNEL: "false"
KC_HTTP_ENABLED: "true"

But now i cannot load the client portal anymore, the 403 moved to /realms/master/account/ "failed to initialize keycloak"
For any advice I am happy!

0 replies

sonic-sw · 2023-04-03T12:18:28Z

sonic-sw
Apr 3, 2023
Author

after adding for "Valid post logout redirect URIs" and "Web origins" a + sign in the client for account and account-console, the issue is resolved

0 replies

Navigation Menu

Repository navigation

K8s Nginx Ingress #19380

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

K8s Nginx Ingress #19380

Uh oh!

Uh oh!

sonic-sw Mar 28, 2023

Replies: 2 comments

Uh oh!

Uh oh!

sonic-sw Mar 28, 2023 Author

Uh oh!

sonic-sw Apr 3, 2023 Author

sonic-sw
Mar 28, 2023

sonic-sw
Mar 28, 2023
Author

sonic-sw
Apr 3, 2023
Author