Keycloak with Traefik in Kubernetes #42775

AlexAseyev · 2025-09-19T14:49:11Z

AlexAseyev
Sep 19, 2025

Before reporting an issue

I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

No response

Describe the bug

I'm trying to deploy Keycloak behind a traefik ingress proxy with a basic self-signed certificate. Keycloak is accessible at:
https://keycloak.k3s-lab.com
and the internal address is:
http://keycloak.keycloak.svc.cluster.local

Version

26.3.3

Regression

The issue is a regression

Expected behavior

I'd like to understand how to configure requests to Keycloak via an internal address. This way, Minio can work via an internal address, and users can access Keycloak via an external address behind Traefik.

Actual behavior

As an example, I'm trying to enable SSO with Keycloak, but I get an error during authorization because Minio needs to access Keycloak via the internal address. A request to:
/realms/ml-team/.well-known/openid-configuration
returns links with an external address, which won't work within Kubernetes.

$ kubectl exec -it minio-6889dd59fb-8pcwg -n minio -- curl -v http://keycloak.keycloak.svc.cluster.local/realms/ml-team/.well-known/openid-configuration
Defaulted container "minio" out of: minio, install-ca-cert (init)
*   Trying 10.43.3.2:80...
* Connected to keycloak.keycloak.svc.cluster.local (10.43.3.2) port 80 (#0)
> GET /realms/ml-team/.well-known/openid-configuration HTTP/1.1
> Host: keycloak.keycloak.svc.cluster.local
> User-Agent: curl/7.88.1
> Accept: */*
> 
< HTTP/1.1 200 OK
< content-length: 6745
< Cache-Control: no-cache, must-revalidate, no-transform, no-store
< Content-Type: application/json;charset=UTF-8
< Referrer-Policy: no-referrer
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< 
{"issuer":"https://keycloak.k3s-lab.com/realms/ml-team","authorization_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/auth","token_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/token","introspection_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/token/introspect","userinfo_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/userinfo","end_session_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/logout","frontchannel_logout_session_supported":true,"frontchannel_logout_supported":true,"jwks_uri":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/certs","check_session_iframe":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/login-status-iframe.html","grant_types_supported":["authorization_code","client_credentials","implicit","password","refresh_token","urn:ietf:params:oauth:grant-type:device_code","urn:ietf:params:oauth:grant-type:token-exchange","urn:ietf:params:oauth:grant-type:uma-ticket","urn:openid:params:grant-type:ciba"],"acr_values_supported":["0","1"],"response_types_supported":["code","none","id_token","token","id_token token","code id_token","code token","code id_token token"],"subject_types_supported":["public","pairwise"],"prompt_values_supported":["none","login","consent"],"id_token_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"id_token_encryption_alg_values_supported":["ECDH-ES+A256KW","ECDH-ES+A192KW","ECDH-ES+A128KW","RSA-OAEP","RSA-OAEP-256","RSA1_5","ECDH-ES"],"id_token_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"userinfo_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"userinfo_encryption_alg_values_supported":["ECDH-ES+A256KW","ECDH-ES+A192KW","ECDH-ES+A128KW","RSA-OAEP","RSA-OAEP-256","RSA1_5","ECDH-ES"],"userinfo_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"request_object_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_encryption_alg_values_supported":["ECDH-ES+A256KW","ECDH-ES+A192KW","ECDH-ES+A128KW","RSA-OAEP","RSA-OAEP-256","RSA1_5","ECDH-ES"],"request_object_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"response_modes_supported":["query","fragment","form_post","query.jwt","fragment.jwt","form_post.jwt","jwt"],"registration_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/clients-registrations/openid-connect","token_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"token_endpoint_auth_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"introspection_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"introspection_endpoint_auth_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_encryption_alg_values_supported":["ECDH-ES+A256KW","ECDH-ES+A192KW","ECDH-ES+A128KW","RSA-OAEP","RSA-OAEP-256","RSA1_5","ECDH-ES"],"authorization_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"claims_supported":["aud","sub","iss","auth_time","name","given_name","family_name","preferred_username","email","acr"],"claim_types_supported":["normal"],"claims_parameter_supported":true,"scopes_supported":["profile","offline_access","address","web-origins","basic","organization","openid","microprofile-jwt","acr","minio-full-access","email","service_account","phone","roles"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"code_challenge_methods_supported":["plain","S256"],"tls_client_certificate_bound_access_tokens":true,"revocation_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/revoke","revocation_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"revocation_endpoint_auth_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"backchannel_logout_supported":true,"backchannel_logout_session_supported":true,"device_authorization_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/auth/device","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_authentication_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/ext/ciba/auth","backchannel_authentication_request_signing_alg_values_supported":["PS384","RS384","EdDSA","ES384","ES256","RS256","ES512","PS256","PS512","RS512"],"require_pushed_authorization_requests":false,"pushed_authorization_request_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/ext/par/request","mtls_endpoint_aliases":{"token_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/token","revocation_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/protocol/openid-connect/revoke","introspection_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/token/introspect","device_authorization_endpoint":"https://keycloak.k3s-lab.com/realms/ml-team/p* Connection #0 to host keycloak.keycloak.svc.cluster.local left intact
rotocol/openid-connect/auth/device","registration_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/clients-registrations/openid-connect","userinfo_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/userinfo","pushed_authorization_request_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/ext/par/request","backchannel_authentication_endpoint":"http://keycloak.keycloak.svc.cluster.local/realms/ml-team/protocol/openid-connect/ext/ciba/auth"},"authorization_response_iss_parameter_supported":true}

How to Reproduce?

k3s version v1.33.4+k3s1 (148243c4)
go version go1.24.5

name: keycloak
sources:

https://github.com/bitnami/charts/tree/main/bitnami/keycloak
version: 25.2.1

name: traefik
sources:

https://github.com/traefik/traefik-helm-chart
https://github.com/traefik/traefik
version: 37.1.0

Anything else?

No response

Navigation Menu

Repository navigation

Keycloak with Traefik in Kubernetes #42775

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Keycloak with Traefik in Kubernetes #42775

Uh oh!

AlexAseyev Sep 19, 2025

Before reporting an issue

Area

Describe the bug

Version

Regression

Expected behavior

Actual behavior

How to Reproduce?

Anything else?

Replies: 0 comments

AlexAseyev
Sep 19, 2025