<p>I'm trying to setup ProxyInjector to automatically inject keycloak-gateway into any container that has annotations like the following I have for a service I'm deploying on kubernetes:</p>

<pre><code>"annotations": {
  "authproxy.stakater.com/client-id": "bitwarden",
  "authproxy.stakater.com/client-secret": "&lt;secret&gt;",
  "authproxy.stakater.com/discovery-url": "https://keycloak.example.com/auth/realms/realmname",
  "authproxy.stakater.com/enabled": "true",
  "authproxy.stakater.com/listen": "127.0.0.1:3000",
  "authproxy.stakater.com/redirection-url": "http://127.0.0.1:3000",
  "authproxy.stakater.com/source-service-name": "bitwarden",
  "authproxy.stakater.com/target-port": "3000",
  "authproxy.stakater.com/upstream-url": "http://127.0.0.1:80",
}
</code></pre>

<p>This is for a bitwardenrs deployment in Kubernetes.  The service is as follows: </p>

<pre><code>---
kind: Service
apiVersion: v1
metadata:
  name: bitwarden
spec:
  selector:
    app: bitwarden
  ports:
    - protocol: TCP
      name: bitwarden-http
      port: 80
      targetPort: 80
    - protocol: TCP
      name: bitwarden-https
      port: 443
      targetPort: 443
  type: NodePort
</code></pre>

<p>I can access the service normally through ingress.  But when I add the annotations to authenticate in front of it, I get a 502 bad gateway error.</p>

<p>Checking the bitwarden pod logs, I can see the proxy container successfully starts up and proxying according to what I defined here.  But I don't see any logs about it actually attempting to proxy anything (either in that pod, or my ingress-controller pod).</p>

<p>&nbsp;</p>

<p>Am I doing something wrong for it to be returning a 502?</p>

<p>As per documentation <a href="https://github.com/stakater/ProxyInjector#usage" rel="nofollow noreferrer">here</a>, 
<code>authproxy.stakater.com/listen</code> is what proxy listens on. so it should be either <code>0.0.0.0:80</code> or <code>0.0.0.0:443</code>. So every call redirected by nginx to the service lands on the proxy container. After the request is verified by keycloak. it will redirect it to the url mentioned in <code>authproxy.stakater.com/redirection-url</code> e.g. <a href="https://cool.myweb.app.com" rel="nofollow noreferrer">https://cool.myweb.app.com</a> (should be accessible to keycloak). The redirected request from keycloak will land again on the proxy container but this time is authenticated and will be redirected to <code>authproxy.stakater.com/upstream-url</code> i.e. your app you are trying to proxy e.g.</p>

<pre><code>Recommended setting is to run proxy on port 80/443 and app on any other port e.g. 3000 etc.
</code></pre>

<p>See <a href="https://github.com/stakater/ProxyInjector/blob/master/docs/ProxyInjectorFlow.md" rel="nofollow noreferrer">Flow diagram</a> for further reference.</p>

<p>Feel free to open an issue in the repository, if you have any further questions.
or ask in the <a href="https://stakater.slack.com/messages/CFCP3MUR4/" rel="nofollow noreferrer">Stakater slack channel</a></p>
