Specify alternate URL for redirect and internal lookups for Keycloak in Kubernetes

Viewed 767

So I have a spring boot application, which is deployed as a pod in Kubernetes. I also have a Keycloak server running in Kubernetes (Same namespace). I am facing an issue with logging into my application through a browser on my local machine.

So I am specifying the auth-server-url=http://keycloak-service-name:8080/auth, so that my pod can access it, and it can. The problem arrises when I try to log in to my application, as it redirects to http://keycloak-service-name:8080/auth and this cannot be resolved locally as it is the Kubernetes service.

I also have ingress set up, so I tried specify the auth URL as the ingress http://keycloak-ingress/auth, but then my pod cannot access this and gets an error "Failed to load URLs from ..." as it cannot resolve the ingress domain. However, I can access the ingress from my browser.

I feel like I am missing something really obvious here, I need some kind of URL that is accessible to both the pod within the cluster, as well as outside the cluster. Or maybe there is someway to specify a seperate URL for the lookup my application is doing to "Load the URL's"?

The only way I have managed to get this to work is by exposing the service externally and using the external IP and port, but this is not an acceptable solution.

1 Answers

I found out that there is a frontend URL parameter in the keycloak server. I set this to point to my ingress, and set the auth-server-url to point to my keycloak service name. This solved my problem, in that when my application does a lookup internally it uses the service, but when I access the frontend it uses the ingress.

Related