<p>Setup:</p>

<ul>
<li>minikube version: v0.27.0</li>
<li>Kong (helm install stable/kong) / version 1.0.2</li>
<li>Keycloak (helm install stable/keycloak) / version 4.8.3.Final</li>
</ul>

<p>I have a self signed SSL certificate for my "hello.local".</p>

<p>What I need to achieve: Keycloak behind Kong at "<a href="https://hello.local/" rel="nofollow noreferrer">https://hello.local/</a>".</p>

<p>My steps:</p>

<p>1) fresh minikube</p>

<p>2) Install Keycloak with helm, following values.yaml:</p>

<pre><code>keycloak:
    basepath: ""
    replicas: 1
    ...
    extraEnv: |
      - name: PROXY_ADDRESS_FORWARDING
        value: "true"
</code></pre>

<p>(that would create service <code>auth-keycloak-http</code>)</p>

<p>3) Install Kong with helm, following values.yaml:</p>

<pre><code>replicaCount: 1
admin:
  ingress:
    enabled: true
    hosts: ['hello.local']
proxy:
  type: LoadBalancer 
  ingress:
    enabled: true
    hosts: ['hello.local']
    tls:
      - hosts:
        - hello.local
        secretName: tls-certificate
    annotations:
      kubernetes.io/ingress.class: "nginx"
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  tls:
    enabled: true
postgresql:
...
</code></pre>

<p>4) I setup service and route for Kong</p>

<p>Service:</p>

<pre><code>Protocol: http
Host: auth-keycloak-http
Port: 80
</code></pre>

<p>Route:</p>

<pre><code>Hosts: hello.local 
</code></pre>

<p>After that I can open "<a href="https://hello.local" rel="nofollow noreferrer">https://hello.local</a>" and can see welcome page from Keycloak where I can click Administration Console and after that I have redirect to "<a href="https://hello.local:8443/admin/master/console/" rel="nofollow noreferrer">https://hello.local:8443/admin/master/console/</a>" in my browser. So we should not have redirect with another port at this point. </p>

<p>Setup with 2 docker images (Keycloak + Kong) is working if <code>PROXY_ADDRESS_FORWARDING</code> is <code>true</code>.</p>

<p>How can I make Keycloak (helm chart) to work behind Kong (helm chart) in kubernetes cluster as expected, without redirect?</p>

<p>This is being discussed in <a href="https://github.com/helm/charts/issues/12272" rel="nofollow noreferrer">github issue 1</a>, <a href="https://github.com/Kong/kubernetes-ingress-controller/issues/291" rel="nofollow noreferrer">github issue 2</a> and <a href="https://github.com/codecentric/helm-charts/issues/17" rel="nofollow noreferrer">github issue 3</a>. Also, Similar questions <a href="https://stackoverflow.com/questions/56021042/cant-access-administration-console-page-with-keycloak-behind-kong-ingress-contr">on stackoverflow</a> </p>

<p>Original answer:</p>
<p>Seems, it is necessary  to setup following environment variables in values.yaml of keycloak helm chart:</p>
<pre><code>...
  extraEnv: |
    - name: KEYCLOAK_HTTP_PORT
      value: &quot;80&quot;
    - name: KEYCLOAK_HTTPS_PORT
      value: &quot;443&quot;
    - name: KEYCLOAK_HOSTNAME
      value: example.com
...
</code></pre>
<p>All of them are required, after that, redirect would work correctly.</p>
<p><strong>Added 2021 Sep:</strong></p>
<p>Issue with <a href="https://github.com/codecentric/helm-charts/issues/473" rel="nofollow noreferrer">weird behavior with redirect to port 8443</a> for some action (like go to Account management with the link on the top right of admin console).</p>
<p>In fact we do not need to set any <code>KEYCLOAK_HTTP_PORT </code> or <code>KEYCLOAK_HTTPS_PORT</code>.</p>
<p>Some changes are required on proxy side. On proxy we need to set <code>x-forwarded-port</code> to <code>443</code> for this route.</p>
<p>In my case we use Kong:</p>
<p>On the route, where Keycloak is exposed, we need to add (this one worked for me):</p>
<p><code>serverless</code> &gt; <code>post function</code> with following content:</p>
<pre class="lang-lua prettyprint-override"><code>ngx.var.upstream_x_forwarded_port=443 
</code></pre>
<p><a href="https://github.com/Kong/kong/issues/5559#issuecomment-585972520" rel="nofollow noreferrer">More info on KONG and x_forwarded_*</a></p>
