• Last Updated: 10 Aug 2023
• Category
• Arvind Das
keycloak nginx kubernetes

Configuring Keycloak on Kubernetes with Nginx Proxy

Hi Everyone

Today we are going to look into the configurations required for setting up keycloak in kubernetes. In this setup we have used mysql database ( present in the cluster) . You can have yours.

We will also see the configurations related to SSL which will be configured using the proxy. So, the ssl terminates at the nginx and then the calls are forwarded to the keycloak instance.

So , lets get started.

We are expecting that you have the setups ready.

1. Kubernetes
2. Keycloak
3. Nginx (our loadbalancer on baremetal kubernetes setup but this could be your own nginx loadbalancer in kube cluster)

The Kubernetes Config:

Keycloak

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  selector:
    app: keycloak
  type: LoadBalancer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
      - name: keycloak
        image: quay.io/keycloak/keycloak:22.0.1
        args: ["start-dev"]
        env:
        - name: KEYCLOAK_ADMIN
          value: "adminuser"
        - name: KEYCLOAK_ADMIN_PASSWORD
          value: "yourpass"
        - name: KC_PROXY
          value: "edge"   
        - name: PROXY_ADDRESS_FORWARDING
          value: "true"     
        - name: KC_DB
          value: mysql
        - name: KC_DB_URL
          value: jdbc:mysql://mysql.dbs.svc.cluster.local/keycloak
        - name: DB_PORT
          value: "3306"
        - name: DB_DATABASE
          value: keycloak
        - name: KC_DB_USERNAME
          value: root
        - name: KC_DB_PASSWORD
          value: yourpass
        - name: KC_HOSTNAME_URL
          value: https://myssldomain.com/    
            
        ports:
        - name: http
          containerPort: 8080
        readinessProbe:
          httpGet:
            path: /realms/master
            port: 8080

So our keycloak is ready now.

Lets have a look at our configuration in the Nginx . The Configuration below uses the letsencrypt for ssl certificates .

server {
	server_name myserver.com;
	#root /var/www/example.com;
	#index index.html;

	location / {
		proxy_pass http://172.19.255.201:8080; //internal ip allocated to the service
		proxy_http_version 1.1;
		proxy_set_header Host $host;
               proxy_set_header X-Real-IP $remote_addr;
               proxy_set_header Upgrade $http_upgrade; 
	       proxy_set_header X-Forwarded-Port 443;
	       proxy_set_header X-Forwarded-Proto $scheme;
	}
    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/myserver.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/myserver.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}


server {
    if ($host = myserver.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot
	server_name myserver.com;
	listen 80;
	listen [::]:80;
    return 404; # managed by Certbot
} 

After above configurations are done. DO NOT forget to configure the allowed origins in your keycloak client else you will continue to see the Access-Control-Allow-Origin and Access-Control-Allow-Credentials errors.

Hope that helps.

Thanks