<p>I have Keycloak (10.0.3) server configured inside a Kubernetes Cluster.</p>
<p>The keycloak server has to handle authentification for external user (using an external url) and also handle oauth2 token for Spring microservices communications.</p>
<p>Then web application spring services uses oidc providers :</p>
<pre><code>spring:
  security:
    oauth2:
      client:
        provider:
          oidc:
            issuer-uri: http://keycloak-cluster-http.keycloak-cluster.svc.cluster.local/auth/realms/myrealm
            authorization-uri: http://keycloak-cluster-http.keycloak-cluster.svc.cluster.local/auth/realms/myrealm/protocol/openid-connect/auth
            jwk-set-uri: http://keycloak-cluster-http.keycloak-cluster.svc.cluster.local/auth/realms/myrealm/protocol/openid-connect/certs
            token-uri: http://keycloak-cluster-http.keycloak-cluster.svc.cluster.local/auth/realms/myrealm/protocol/openid-connect/token
            user-name-attribute: preferred_username
</code></pre>
<p>The external URL of keycloak is <a href="https://keycloak.localhost" rel="nofollow noreferrer">https://keycloak.localhost</a>, managed by ingress redirection handled by Traefik v2</p>
<pre><code>apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: keycloak-https
  namespace: keycloak-cluster
  annotations:
    traefik.frontend.passHostHeader: &quot;true&quot;
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`keycloak.localhost`)
      kind: Rule
      services:
        - name: keycloak-cluster-http
          port: 80
  tls:
    options:
      name: mytlsoption
      namespace: traefik
    store:
      name: default
</code></pre>
<p>I can access Keycloak using <a href="https://keycloak.localhost" rel="nofollow noreferrer">https://keycloak.localhost</a>, no problem, it works.</p>
<p>The problem is that when I try to access my web application, it will always redirect to 'http://keycloak-cluster-http.keycloak-cluster.svc.cluster.local/auth/realms/myrealm', which is not resolved outside k8s.</p>
<p>If I change issuer-uri to <a href="http://keycloak.localhost" rel="nofollow noreferrer">http://keycloak.localhost</a> then it doesn't work as keycloak.locahost is not resolved inside k8s.</p>
<p>I tried to set the KEYCLOAK_FRONTEND_URL to <a href="https://keycloak.localhost/auth" rel="nofollow noreferrer">https://keycloak.localhost/auth</a>, but no change.</p>
<p>Please, does someone has the same kind of settings and managed to make it working ?</p>
<p>Best regards</p>

<p>Managed to fix it using coredns and adding a rewrite rule... :</p>
<p><strong>rewrite name keycloak.localhost keycloak-cluster-http.keycloak-cluster.svc.cluster.local</strong></p>
<pre><code>apiVersion: v1
data:
  Corefile: |
    .:53 {
        errors
        health
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        }
        rewrite name keycloak.localhost keycloak-cluster-http.keycloak-cluster.svc.cluster.local
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
</code></pre>
