<p>I'm trying to run a minimalistic sample of oauth2-proxy with Keycloak. I used oauth2-proxy's <a href="https://github.com/oauth2-proxy/oauth2-proxy/tree/master/contrib/local-environment/kubernetes" rel="nofollow noreferrer">k8s example</a>, which uses dex, to build up my keycloak example.
The problem is that I don't seem to get the proxy to work:</p>
<pre class="lang-sh prettyprint-override"><code># kubectl get pods                     
NAME                            READY   STATUS             RESTARTS   AGE
httpbin-774999875d-zbczh        1/1     Running            0          2m49s
keycloak-758d7c758-27pgh        1/1     Running            0          2m49s
oauth2-proxy-5875dd67db-8qwqn   0/1     CrashLoopBackOff   2          2m49s
</code></pre>
<p>Logs indicate a network error:</p>
<pre class="lang-sh prettyprint-override"><code># kubectl logs oauth2-proxy-5875dd67db-8qwqn
[2021/09/22 08:14:56] [main.go:54] Get &quot;http://keycloak.localtest.me/auth/realms/master/.well-known/openid-configuration&quot;: dial tcp 127.0.0.1:80: connect: connection refused
</code></pre>
<p>I believe I have set up the ingress correctly, though.</p>
<h3>Steps to reproduce</h3>
<ol>
<li>Set up the cluster:</li>
</ol>
<pre class="lang-sh prettyprint-override"><code>#Creare kind cluster
wget https://raw.githubusercontent.com/oauth2-proxy/oauth2-proxy/master/contrib/local-environment/kubernetes/kind-cluster.yaml
kind create cluster --name oauth2-proxy --config kind-cluster.yaml
#Setup dns
wget https://raw.githubusercontent.com/oauth2-proxy/oauth2-proxy/master/contrib/local-environment/kubernetes/custom-dns.yaml
kubectl apply -f custom-dns.yaml
kubectl -n kube-system rollout restart deployment/coredns
kubectl -n kube-system rollout status --timeout 5m deployment/coredns
#Setup ingress
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml
kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
#Deploy
#import keycloak master realm
wget https://raw.githubusercontent.com/oauth2-proxy/oauth2-proxy/master/contrib/local-environment/keycloak/master-realm.json 
kubectl create configmap keycloak-import-config --from-file=master-realm.json=master-realm.json
</code></pre>
<ol start="2">
<li>Deploy the test application. My <code>deployment.yaml</code> file:</li>
</ol>
<pre class="lang-yaml prettyprint-override"><code>###############oauth2-proxy#############
apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  labels:
    name: oauth2-proxy
  name: oauth2-proxy
spec:
  replicas: 1
  selector:
      matchLabels:
        name: oauth2-proxy
  template:
    metadata:
      labels:
        name: oauth2-proxy
    spec:
      containers:
        - args:
            - --provider=oidc
            - --oidc-issuer-url=http://keycloak.localtest.me/auth/realms/master
            - --upstream=&quot;file://dev/null&quot;
            - --client-id=oauth2-proxy
            - --client-secret=72341b6d-7065-4518-a0e4-50ee15025608
            - --cookie-secret=x-1vrrMhC-886ITuz8ySNw==
            - --email-domain=*
            - --scope=openid profile email users
            - --cookie-domain=.localtest.me
            - --whitelist-domain=.localtest.me
            - --pass-authorization-header=true
            - --pass-access-token=true
            - --pass-user-headers=true
            - --set-authorization-header=true
            - --set-xauthrequest=true
            - --cookie-refresh=1m
            - --cookie-expire=30m
            - --http-address=0.0.0.0:4180
          image: quay.io/oauth2-proxy/oauth2-proxy:latest
          # image: &quot;quay.io/pusher/oauth2_proxy:v5.1.0&quot;
          name: oauth2-proxy
          ports:
            - containerPort: 4180
              name: http
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /ping
              port: http
              scheme: HTTP
            initialDelaySeconds: 0
            timeoutSeconds: 1
          readinessProbe:
            httpGet:
              path: /ping
              port: http
              scheme: HTTP
            initialDelaySeconds: 0
            timeoutSeconds: 1
            successThreshold: 1
            periodSeconds: 10
          resources:
            {}
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: oauth2-proxy
  name: oauth2-proxy
spec:
  type: ClusterIP
  ports:
    - port: 4180
      targetPort: 4180
      name: http
  selector:
    name: oauth2-proxy
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  labels:
    app: oauth2-proxy
  name: oauth2-proxy
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
      large_client_header_buffers 4 32k;
spec:
  rules:
    - host: oauth2-proxy.localtest.me
      http:
        paths:
          - path: /
            backend:
              serviceName: oauth2-proxy
              servicePort: 4180
---
# ######################httpbin##################
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      name: httpbin
  template:
    metadata:
      labels:
        name: httpbin
    spec:
      containers:
        - image: kennethreitz/httpbin:latest
          name: httpbin
          resources: {}
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
          readinessProbe:
            httpGet:
              path: /
              port: http
      hostname: httpbin
      restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin-svc
  labels:
    app: httpbin
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      protocol: TCP
      name: http
  selector:
    name: httpbin
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: httpbin
  labels:
    name: httpbin
  annotations:
    nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
    nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
    nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
spec:
  rules:
    - host: httpbin.localtest.me
      http:
        paths:
          - path: /
            backend:
              serviceName: httpbin-svc
              servicePort: 80
---
# ######################keycloak#############
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: keycloak
  name: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
        - args:
            - -Dkeycloak.migration.action=import
            - -Dkeycloak.migration.provider=singleFile
            - -Dkeycloak.migration.file=/etc/keycloak_import/master-realm.json
            - -Dkeycloak.migration.strategy=IGNORE_EXISTING
          env:
            - name: KEYCLOAK_PASSWORD
              value: password
            - name: KEYCLOAK_USER
              value: admin@example.com
            - name: KEYCLOAK_HOSTNAME
              value: keycloak.localtest.me
            - name: PROXY_ADDRESS_FORWARDING
              value: &quot;true&quot;
          image: quay.io/keycloak/keycloak:15.0.2
          # image: jboss/keycloak:10.0.0
          name: keycloak
          ports:
            - name: http
              containerPort: 8080
            - name: https
              containerPort: 8443
          readinessProbe:
            httpGet:
              path: /auth/realms/master
              port: 8080
          volumeMounts:
            - mountPath: /etc/keycloak_import
              name: keycloak-config
      hostname: keycloak
      volumes:
      - configMap:
          defaultMode: 420
          name: keycloak-import-config
        name: keycloak-config
---
apiVersion: v1
kind: Service
metadata:
  name: keycloak-svc
  labels:
    app: keycloak
spec:
  type: ClusterIP
  sessionAffinity: None
  ports:
  - name: http
    targetPort: http
    port: 8080
  selector:
    app: keycloak
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: keycloak
spec:
  tls:
    - hosts:
      - &quot;keycloak.localtest.me&quot;
  rules:
  - host: &quot;keycloak.localtest.me&quot;
    http:
      paths:
      - path: /
        backend:
          serviceName: keycloak-svc
          servicePort: 8080
---

</code></pre>
<pre class="lang-sh prettyprint-override"><code># kubectl apply -f deployment.yaml
</code></pre>
<ol start="3">
<li>Configure <code>/etc/hosts</code> on the development machine file to include <code>localtest.me</code> domain:</li>
</ol>
<pre><code>127.0.0.1       oauth2-proxy.localtest.me
127.0.0.1       keycloak.localtest.me
127.0.0.1       httpbin.localtest.me
127.0.0.1       localhost
</code></pre>
<p>Note that I can reach <code>http://keycloak.localtest.me/auth/realms/master/.well-known/openid-configuration</code> with no problem from my host browser. It appears that the <code>oauth2-proxy</code>'s pod cannot reach the service via the ingress. Would really appreciate any sort of help here.</p>

<p>Turned out that I needed to add keycloak to <code>custom-dns.yaml</code>.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
data:
  Corefile: |
    .:53 {
        errors
        health {
           lameduck 5s
        }
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        }
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
        hosts {
            10.244.0.1 dex.localtest.me. # &lt;----Configured for dex
            10.244.0.1 oauth2-proxy.localtest.me
            fallthrough
        }
    }
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
</code></pre>
<p>Added keycloak showed as below:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
data:
  Corefile: |
    .:53 {
        errors
        health {
           lameduck 5s
        }
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        }
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
        hosts {
            10.244.0.1 keycloak.localtest.me
            10.244.0.1 oauth2-proxy.localtest.me
            fallthrough
        }
    }
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
</code></pre>
