Can't access Administration Console page with keycloak behind Kong Ingress Controller about helm-charts

[jhonyscamacho]

Anyone?
Please guys, help me. I'm stuck in this problem and I have no idea how to solve it.

[jhonyscamacho]

Anybody?

[Igor-lkm]

I have similar issue here: helm/charts#12272

TL;TR

Keycloak works ok behind, for example, express-gateway. So, seems that the problem is with Kong then? 🤔

/cc @thibaultcha 🙏

[jhonyscamacho]

In a kong community in Gitter I received a tip from @bungle: Configure reverse proxy (kong Ingress in this case) to properly set X-Forwarded-For and X-Forwarded-Proto HTTP headers. See keycloak load balancer docs

I found Response Transformer kong plugin that allows to add headers to the responses.

My question is: once I set the X-Forwarded-For and X-Forwarded-Proto headers in the response what kind of values should I configure in each header assuming that this values could be dynamic? Is there any environment variables that we could use?

Additional informations about configuring plugin in Kong Ingress:

https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/annotations.md#pluginskonghqcom

https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/deployment/minikube.md#configure-a-kong-plugin-using-annotations-in-ingress

[jhonyscamacho]

Just for the record: @bungle clarified my previous question.

According to @bungle kong sets the forwarded headers.

He shared with us this links:

https://github.com/Kong/kong/blob/master/kong/templates/nginx_kong.lua#L143-L146
https://github.com/Kong/kong/blob/master/kong/runloop/handler.lua#L869-L880

[method350]

Had a similar issue with kong. Get rid of kong, use traefik instead of this thing.

The trick was the proper combination of keycloak ingress and kong configuration.

Below my working kong configuration:

apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: keycloak-ingress-conf
upstream:
  hash_on: cookie
  hash_on_cookie: X-KONG-STICKY
  hash_fallback: none
proxy:
  protocol: http
  path: /
  connect_timeout: 10000
  retries: 10
  read_timeout: 10000
  write_timeout: 10000
route:
  methods:
    - POST
    - GET
    - PATCH
    - HEAD
    - PUT
    - CONNECT
    - OPTIONS
    - DELETE
  regex_priority: 0
  strip_path: false
  preserve_host: true
  protocols:
    - http
    - https

Then configure the keycloak ingress with that kong config and you should be fine.

keycloak:
  replicas: 3
  ingress:
    annotations:
      kubernetes.io/ingress.class: kong
      configuration.konghq.com: "keycloak-ingress-conf"
  extraEnv: |
    - name: PROXY_ADDRESS_FORWARDING
      value: "true"

Maybe you will not need this ' kubernetes.io/ingress.class: kong' annotation. Good luck!

[jhonyscamacho]

Hi guys!

The problem was solved.

The solution can be found here.

@Igor-lkm take a look at the link above. Maybe it can help you.

[allenvino1]

@jhonyscamacho Having the same issue also ^ but I binded the port on 80 with keycloak already and still having the error.

[Igor-lkm]

Update: Kong/kubernetes-ingress-controller#291 (comment)

[anand188]

does any one has any solution . Its not working with all suggested solutions