I have a Keycloak server running in an EKS cluster that I'm trying to configure for production instead of dev mode.
I've managed to get SSL working with a reverse proxy, but when I go to the login page for the admin console it just loads indefinitely.
Here's my configuration:
Dockerfile
FROM --platform=linux/arm64 quay.io/keycloak/keycloak:19.0.1 as builder
ENV KC_DB=postgres
ENV KC_PROXY=edge
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange
ENV KC_HTTP_RELATIVE_PATH=/auth
RUN /opt/keycloak/bin/kc.sh build
FROM --platform=linux/arm64 quay.io/keycloak/keycloak:19.0.1
COPY --from=builder /opt/keycloak/ /opt/keycloak/
## Install custom providers
COPY auth-identione-extension/target/auth-identione-extension-1.0.0-SNAPSHOT.jar /opt/keycloak/providers
ENV KC_HOSTNAME_STRICT=false
ENV KC_KEYCLOAK_USER={user}
ENV KC_KEYCLOAK_PASSWORD={password}
ENV KC_DB_URL={dburl}
ENV KC_DB_USERNAME={dbusername}
ENV KC_DB_PASSWORD={dbpassword}
ENV KC_HTTP_ENABLED=true
ENV KC_HOSTNAME=auth.identione.com
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized"]
deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: default
name: keycloak-deployment
spec:
selector:
matchLabels:
app.kubernetes.io/name: keycloak-app
replicas: 1
template:
metadata:
labels:
app.kubernetes.io/name: keycloak-app
spec:
containers:
- image: {keycloak-img-url}
name: keycloak-app
resources:
requests:
memory: "512Mi"
cpu: "500m"
limits:
memory: "1024Mi"
cpu: "1000m"
imagePullPolicy: Always
ports:
- name: http
containerPort: 8080
service.yaml
apiVersion: v1
kind: Service
metadata:
namespace: default
name: keycloak-service
spec:
ports:
- port: 8180
targetPort: 8080
protocol: TCP
type: NodePort
selector:
app.kubernetes.io/name: keycloak-app
ingress.yaml
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
namespace: default
name: keycloak-service-ingress
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/target-type: ip
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
alb.ingress.kubernetes.io/certificate-arn: {certificate-arn}
alb.ingress.kubernetes.io/ssl-redirect: 'https'
spec:
rules:
- host: auth.identione.com
http:
paths:
- path: /*
backend:
serviceName: keycloak-service
servicePort: 8180
Found the issue.
I had to move the ENV KC_PROXY=edge
variable in the Dockerfile after running the build script.