[codecentric/keycloak] Extend README with an example for custom admin console port about helm-charts

[flapouille]

How is it supposed to work ?

When I set keycloak.extraPorts="9999" , I get following error:

Error: UPGRADE FAILED: YAML parse error on keycloak/templates/statefulset.yaml: error converting YAML to JSON: yaml: line 113: could not find expected ':'

[marcoapvilhena]

@flapouille I have the same issue.

[flapouille]

@marcoapvilhena in the end I didn't use keycloak.extraPorts . I only use a startup script in order to redirect to another port . with a classical port forward , it's working great.

[marcoapvilhena]

@flapouille nice... but how did you for the Admin start in another port? Here is starting at port 80, I need expose to internet for the applications authenticates for custom realms and can't do the same for the Admin.

[flapouille]

in your values.yaml, you should define your startupScript . This one works

startupScripts: 
    restrict_port.cli: |
      embed-server --server-config=standalone-ha.xml --std-out=echo
      /socket-binding-group=standard-sockets/socket-binding=http-admin/:add(port=${jboss.http.port:9991})
      /subsystem=undertow/server=default-server/http-listener=http-admin:add(socket-binding=http-admin, enable-http2=true)
      /subsystem=undertow/configuration=filter/expression-filter=portAccess:add(,expression="path-prefix('/auth/admin') and not equals(%p, 9991) -> response-code(403)")
      /subsystem=undertow/server=default-server/host=default-host/filter-ref=portAccess:add()
      stop-embedded-server

[flapouille]

by the way, extraPorts get defined as a string, which means

  extraPorts: |
    - name: admin-port
      containerPort: 9999
      protocol: TCP

[scramboy]

Question on configuring ingress after exposing additional admin-port in the service. If I am reading it right in the ingress.yaml, the below line hardcode the port you could reference in ingress.

servicePort: {{ $ingress.servicePort }}

The use case we have is to expose multiple ingress hosts, one for regular auth traffic, and another for full access including adminConsole. We have something else in front of ingress for SSL offloading, and we could separate user traffic with this so that external users could not access adminConsole.

I would like to request allowing a more detailed configuration in ingress, allowing different servicePort to be specified when adding custom ingress rules. I would be happy to provide a PR if the proposal is accepted. Thanks.

[unguiculus]

FYI: The latest version of the chart already includes the admin port (9990). You can reconfigure the service port if you like, but why would you want to use a custom container port?

[github-actions]

This issue has been marked as stale because it has been open for 30 days with no activity. It will be automatically closed in 10 days if no further activity occurs.