<p>I have istio installed and can see it on Rancher. I have keycloak installed as well. I am trying to connect the two and have a gateway setup so I can access keycloak front-end through a URL.
In my keycloak manifest I have </p>

<pre><code># Source: keycloak/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: keycloak
. 
. #Many other lines here
.
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
</code></pre>

<p>I then setup a gateway with command - </p>

<pre><code>kubectl apply -f networking/custom-gateway.yaml
</code></pre>

<p>And in my custom-gateway.yaml file I have - </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: keycloak-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: keycloak
spec:
  hosts:
  - "*"
  gateways:
  - keycloak-gateway
  http:
  - match:
    - uri:
        exact: /keycloak 
    rewrite:
      uri: "/" # Non context aware backend
    route:
    - destination:
        host: keycloak
        port:
          number: 80
    websocketUpgrade: true
</code></pre>

<p>Now when I try to access the URL with <a href="http://node_ip_address:port/keycloak" rel="nofollow noreferrer">http://node_ip_address:port/keycloak</a>, I find that I am not able to access the front end. I have verified that keycloak is installed and the pod is up and running on Rancher.
I also have my istio instance connected to the <a href="https://istio.io/docs/examples/bookinfo/" rel="nofollow noreferrer">bookinfo application</a> and am able to run the bookinfo-gateway and connect to <a href="http://node_ip_address:port/productpage" rel="nofollow noreferrer">http://node_ip_address:port/productpage</a> with a gateway that looks like the one described <a href="https://github.com/istio/istio/blob/master/samples/bookinfo/networking/bookinfo-gateway.yaml" rel="nofollow noreferrer">here</a>. I am trying to setup the same gateway only for keycloak. 
What am I doing wrong in my yaml files. How do I fix this? Any help is appreciated. Do I have the ports connected correctly? </p>

<p>As far as I can see, you should fix your Virtual Service.</p>

<p>I prepared small example with <a href="https://helm.sh/" rel="nofollow noreferrer">helm</a> and <a href="https://github.com/helm/charts/tree/master/stable/keycloak" rel="nofollow noreferrer">keycloak helm chart</a>.</p>

<hr>

<p>Save this as keycloak.yaml, you can configure your keycloak password here.</p>

<pre><code>keycloak:
  service:
    type: ClusterIP
  password: mykeycloakadminpasswd
  persistence:
    deployPostgres: true
    dbVendor: postgres
</code></pre>

<hr>

<p>Install keycloak with helm and values prepared above.</p>

<hr>

<pre><code>helm upgrade --install keycloak stable/keycloak -f keycloak.yml
</code></pre>

<hr>

<p>Create gateway and virtual service</p>

<hr>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: keycloak-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: keycloak
spec:
  hosts:
  - "*"
  gateways:
  - keycloak-gateway
  http:
  - match:
    - uri:
        prefix: /auth
    - uri:
        prefix: /keycloak
    rewrite:
      uri: /auth
    route:
    - destination:
        host: keycloak-http
        port:
          number: 80
</code></pre>

<p>virtual service <code>route.host</code> is name of kubernetes keycloak pod <strong>service</strong>.</p>

<blockquote>
  <p>kubectl get svc</p>
</blockquote>

<pre><code>NAME                  TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
keycloak-http         ClusterIP   10.0.14.36    &lt;none&gt;        80/TCP     22m
</code></pre>

<p>You should be able to connect to keycloak via your ingress_gateway_ip/keycloak or ingress_gateway_ip/auth and login with keycloak credentials, in my example it's <code>login: keycloak</code> and <code>password: mykeycloakadminpasswd</code>. </p>

<p><strong>Note</strong> that you need to add prefix for /auth as it's default keycloak web to do everything. Keycloak prefix just rewrite to /auth here.</p>
