<p>Following the instructions on the Keycloak docs site below, I'm trying to set up Keycloak to run in a Kubernetes cluster. I have an Ingress Controller set up which successfully works for a simple test page. Cloudflare points the domain to the ingress controllers IP.</p>
<p>Keycloak deploys successfully (<code>Admin console listening on http://127.0.0.1:9990</code>), but when going to the domain I get a message from NGINX: <code>503 Service Temporarily Unavailable</code>.</p>
<p><a href="https://www.keycloak.org/getting-started/getting-started-kube" rel="nofollow noreferrer">https://www.keycloak.org/getting-started/getting-started-kube</a></p>
<p>Here's the Kubernetes config:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: keycloak-cip
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    name: keycloak
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    service.beta.kubernetes.io/linode-loadbalancer-default-protocol: https
    service.beta.kubernetes.io/linode-loadbalancer-port-443: '{ &quot;tls-secret-name&quot;: &quot;my-secret&quot;, &quot;protocol&quot;: &quot;https&quot; }'
spec:
  rules:
    - host: my.domain.com
      http:
        paths:
          - backend:
              serviceName: keycloak-cip
              servicePort: 8080
  tls:
    - hosts:
        - my.domain.com
      secretName: my-secret
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  namespace: default
  labels:
    app: keycloak
spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
        - name: keycloak
          image: quay.io/keycloak/keycloak:12.0.3
          env:
            - name: KEYCLOAK_USER
              value: &quot;admin&quot;
            - name: KEYCLOAK_PASSWORD
              value: &quot;admin&quot;
            - name: PROXY_ADDRESS_FORWARDING
              value: &quot;true&quot;
          ports:
            - name: http
              containerPort: 8080
            - name: https
              containerPort: 8443
          readinessProbe:
            httpGet:
              path: /auth/realms/master
              port: 8080
            initialDelaySeconds: 90
            periodSeconds: 5
            failureThreshold: 30
            successThreshold: 1
  revisionHistoryLimit: 1

</code></pre>
<hr />
<p>Edit:</p>
<p>TLS should be handled by the ingress controller.</p>
<p>--</p>
<p>Edit 2:</p>
<p>If I go into the controller using kubectl exec, I can do <code>curl -L http://127.0.0.1:8080/auth</code> which successfully retrieves the page:
<code>&lt;title&gt;Welcome to Keycloak&lt;/title&gt;</code>. So I'm sure that keycloak is running. It's just that either traffic doesn't reach the pod, or keycloak doesn't respond.</p>
<p>If I use the ClusterIP instead but otherwise keep the call above the same, I get a <code>Connection timed out</code>. I tried both ports 80 and 8080 with the same result.</p>

<p>The following configuration is required to run <strong>keycloak</strong> behind <strong>ingress controller</strong>:</p>
<pre><code>- name: PROXY_ADDRESS_FORWARDING
  value: &quot;true&quot;
- name: KEYCLOAK_HOSTNAME
  value: &quot;my.domain.com&quot;
</code></pre>
<p>So I think adding correct <strong>KEYCLOAK_HOSTNAME</strong> value should solve your issue.</p>
<p>I had a similar issue with Traefik Ingress Controller:
<strong><a href="https://stackoverflow.com/questions/67828817/cant-expose-keycloak-server-on-aws-with-traefik-ingress-controller-and-aws-http">Can&#39;t expose Keycloak Server on AWS with Traefik Ingress Controller and AWS HTTPS Load Balancer</a></strong></p>
<p>You can find the full code of my configuration here:
<strong><a href="https://github.com/skyglass-examples/user-management-keycloak" rel="nofollow noreferrer">https://github.com/skyglass-examples/user-management-keycloak</a></strong></p>
