<p>I am trying to get an nginx application authenticated using the keycloak identity provider by following this article - <a href="https://cloud.redhat.com/blog/adding-authentication-to-your-kubernetes-web-applications-with-keycloak" rel="nofollow noreferrer">https://cloud.redhat.com/blog/adding-authentication-to-your-kubernetes-web-applications-with-keycloak</a></p>
<p>Here are my setup and config details which i am trying to apply.</p>
<p>ingress controller - <a href="https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.0/deploy/static/provider/baremetal/deploy.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.0/deploy/static/provider/baremetal/deploy.yaml</a></p>
<p>CNI - <a href="https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml" rel="nofollow noreferrer">https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml</a></p>
<pre><code>kubeadmin@kubemaster:/etc/kubernetes/manifests$ kubectl get nodes -o wide
NAME         STATUS   ROLES                  AGE     VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
kubemaster   Ready    control-plane,master   4d11h   v1.23.1   192.168.122.54    &lt;none&gt;        Ubuntu 20.04.3 LTS   5.11.0-43-generic   docker://20.10.12
kubenode     Ready    &lt;none&gt;                 4d10h   v1.23.1   192.168.122.198   &lt;none&gt;        Ubuntu 20.04.3 LTS   5.11.0-43-generic   docker://20.10.12
</code></pre>
<p>Deployment, service and ingress file trying to apply</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
      - name: gatekeeper
        image: carlosedp/keycloak-gatekeeper:latest
        args:
        - --config=/etc/keycloak-gatekeeper.conf
        ports:
        - containerPort: 3000
          name: service
        volumeMounts:
        - name: gatekeeper-config
          mountPath: /etc/keycloak-gatekeeper.conf
          subPath: keycloak-gatekeeper.conf
        - name: gatekeeper-files
          mountPath: /html
      volumes:
      - name : gatekeeper-config
        configMap:
          name: gatekeeper-config
      - name : gatekeeper-files
        configMap:
          name: gatekeeper-files
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gatekeeper-config
  namespace: default
  creationTimestamp: null
data:
  keycloak-gatekeeper.conf: |+
    # is the url for retrieve the OpenID configuration - normally the &lt;server&gt;/auth/realms/&lt;realm_name&gt;
    discovery-url: https://192.168.122.54:8443/auth/realms/local
    # skip tls verify
    skip-openid-provider-tls-verify: true
    # the client id for the 'client' application
    client-id: gatekeeper
    # the secret associated to the 'client' application
    client-secret: 50f6177f-4c66-4def-81f9-a4bd4ec2491b
    # the interface definition you wish the proxy to listen, all interfaces is specified as ':&lt;port&gt;', unix sockets as unix://&lt;REL_PATH&gt;|&lt;/ABS PATH&gt;
    listen: :3000
    # whether to enable refresh tokens
    enable-refresh-tokens: true
    # the location of a certificate you wish the proxy to use for TLS support
    #tls-cert:
    # the location of a private key for TLS
    #tls-private-key:
    # the redirection url, essentially the site url, note: /oauth/callback is added at the end
    redirection-url: http://kubemaster
    secure-cookie: false
    # the encryption key used to encode the session state
    encryption-key: vGcLt8ZUdPX5fXhtLZaPHZkGWHZrT6aa
    # the upstream endpoint which we should proxy request
    upstream-url: http://127.0.0.1:80/
    forbidden-page: /html/access-forbidden.html
    resources:
    - uri: /*
      groups:
      - my-app
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gatekeeper-files
  namespace: default
  creationTimestamp: null
data:
  access-forbidden.html: |+
    &lt;html lang=&quot;en&quot;&gt;&lt;head&gt; &lt;title&gt;Access Forbidden&lt;/title&gt;&lt;style&gt;*{font-family: &quot;Courier&quot;, &quot;Courier New&quot;, &quot;sans-serif&quot;; margin:0; padding: 0;}body{background: #233142;}.whistle{width: 20%; fill: #f95959; margin: 100px 40%; text-align: left; transform: translate(-50%, -50%); transform: rotate(0); transform-origin: 80% 30%; animation: wiggle .2s infinite;}@keyframes wiggle{0%{transform: rotate(3deg);}50%{transform: rotate(0deg);}100%{transform: rotate(3deg);}}h1{margin-top: -100px; margin-bottom: 20px; color: #facf5a; text-align: center; font-size: 90px; font-weight: 800;}h2, a{color: #455d7a; text-align: center; font-size: 30px; text-transform: uppercase;}&lt;/style&gt; &lt;/head&gt;&lt;body&gt; &lt;use&gt; &lt;svg version=&quot;1.1&quot; xmlns=&quot;http://www.w3.org/2000/svg&quot; xmlns:xlink=&quot;http://www.w3.org/1999/xlink&quot; x=&quot;0px&quot; y=&quot;0px&quot; viewBox=&quot;0 0 1000 1000&quot; enable-background=&quot;new 0 0 1000 1000&quot; xml:space=&quot;preserve&quot; class=&quot;whistle&quot;&gt;&lt;g&gt;&lt;g transform=&quot;translate(0.000000,511.000000) scale(0.100000,-0.100000)&quot;&gt;&lt;path d=&quot;M4295.8,3963.2c-113-57.4-122.5-107.2-116.8-622.3l5.7-461.4l63.2-55.5c72.8-65.1,178.1-74.7,250.8-24.9c86.2,61.3,97.6,128.3,97.6,584c0,474.8-11.5,526.5-124.5,580.1C4393.4,4001.5,4372.4,4001.5,4295.8,3963.2z&quot;/&gt;&lt;path d=&quot;M3053.1,3134.2c-68.9-42.1-111-143.6-93.8-216.4c7.7-26.8,216.4-250.8,476.8-509.3c417.4-417.4,469.1-463.4,526.5-463.4c128.3,0,212.5,88.1,212.5,224c0,67-26.8,97.6-434.6,509.3c-241.2,241.2-459.5,449.9-488.2,465.3C3181.4,3180.1,3124,3178.2,3053.1,3134.2z&quot;/&gt;&lt;path d=&quot;M2653,1529.7C1644,1445.4,765.1,850,345.8-32.7C62.4-628.2,22.2-1317.4,234.8-1960.8C451.1-2621.3,947-3186.2,1584.6-3500.2c1018.6-501.6,2228.7-296.8,3040.5,515.1c317.8,317.8,561,723.7,670.1,1120.1c101.5,369.5,158.9,455.7,360,553.3c114.9,57.4,170.4,65.1,1487.7,229.8c752.5,93.8,1392,181.9,1420.7,193.4C8628.7-857.9,9900,1250.1,9900,1328.6c0,84.3-67,172.3-147.4,195.3c-51.7,15.3-790.8,19.1-2558,15.3l-2487.2-5.7l-55.5-63.2l-55.5-61.3v-344.6V719.8h-411.7h-411.7v325.5c0,509.3,11.5,499.7-616.5,494C2921,1537.3,2695.1,1533.5,2653,1529.7z&quot;/&gt;&lt;/g&gt;&lt;/g&gt;&lt;/svg&gt;&lt;/use&gt;&lt;h1&gt;403&lt;/h1&gt;&lt;h2&gt;Not this time, access forbidden!&lt;/h2&gt;&lt;h2&gt;&lt;a href=&quot;/oauth/logout?redirect=https://google.com&quot;&gt;Logout&lt;/h2&gt;&lt;/body&gt;&lt;/html&gt;
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: nginx
  name: nginx
  namespace: default
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 3000 
  selector:
    app: nginx
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    name: nginx
    namespace: default
    annotations:
      nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: kubemaster 
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80
  defaultBackend:
    service:
      name: nginx 
      port:
        number: 80
</code></pre>
<p>After applying the yml definition, the pods, services and ingress everything is running</p>
<pre><code>kubeadmin@kubemaster:~/stack/keycloak$ kubectl get pods,svc,rs,ingress -o wide
NAME                        READY   STATUS    RESTARTS   AGE   IP             NODE       NOMINATED NODE   READINESS GATES
pod/nginx-bb47fbd49-sbqhv   2/2     Running   0          34m   192.168.1.30   kubenode   &lt;none&gt;           &lt;none&gt;

NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE     SELECTOR
service/kubernetes   ClusterIP   10.96.0.1       &lt;none&gt;        443/TCP   4d11h   &lt;none&gt;
service/nginx        ClusterIP   10.100.36.168   &lt;none&gt;        80/TCP    34m     app=nginx

NAME                              DESIRED   CURRENT   READY   AGE   CONTAINERS         IMAGES                                       SELECTOR
replicaset.apps/nginx-bb47fbd49   1         1         1       34m   nginx,gatekeeper   nginx,carlosedp/keycloak-gatekeeper:latest   app=nginx,pod-template-hash=bb47fbd49

NAME                              CLASS    HOSTS        ADDRESS   PORTS   AGE
ingress.networking.k8s.io/nginx   &lt;none&gt;   kubemaster             80      34m
</code></pre>
<p>But i am unable to launch the application on http://kubemaster:80/ which as per the flow should route to the nginx service backend hosting the gatekeeper proxy.</p>
<p>The service description shows the endpoints of the pod and also i am able to directly hit the service backend which is <a href="http://192.168.1.30:3000/" rel="nofollow noreferrer">http://192.168.1.30:3000/</a> which takes me to keycloak authentication page.</p>
<pre><code>kubeadmin@kubemaster:~/stack/keycloak$ kubectl describe service nginx
Name:              nginx
Namespace:         default
Labels:            app=nginx
Annotations:       &lt;none&gt;
Selector:          app=nginx
Type:              ClusterIP
IP Family Policy:  SingleStack
IP Families:       IPv4
IP:                10.100.36.168
IPs:               10.100.36.168
Port:              http  80/TCP
TargetPort:        3000/TCP
Endpoints:         192.168.1.30:3000
Session Affinity:  None
Events:            &lt;none&gt;
</code></pre>
<p>Error -</p>
<pre><code>kubeadmin@kubemaster:~/stack/keycloak$ curl http://kubemaster/
curl: (7) Failed to connect to kubemaster port 80: Connection refused
</code></pre>
<p>Any suggestions or direction would greatly help..</p>
<p>Thanks
Sudhir</p>

sb9
<p>After reading through the nginx ingress controller <a href="https://kubernetes.github.io/ingress-nginx/deploy/#quick-start" rel="nofollow noreferrer">documentation</a>, i was able to resolve my ingress issue. Here are the steps taken to resolve the issue.</p>
<p>&quot;nginx&quot; deployment yml definition remains the same.</p>
<p>&quot;gatekeeper-config&quot; updated with &quot;redirection-url: <a href="http://demo.localdev.me:8080/%22" rel="nofollow noreferrer">http://demo.localdev.me:8080/&quot;</a>.</p>
<p>&quot;gatekeeper-files&quot; yml definition remains the same.</p>
<p>&quot;nginx&quot; service yml definition remains the same.</p>
<p>&quot;nginx&quot; ingress yml definition updated as shown below. It basically maps
&quot;demo.localdev.me&quot; to &quot;localhost&quot;</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    name: nginx
    namespace: default
    annotations:
      nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: demo.localdev.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx
            port:
              number: 80
</code></pre>
<p>After the required changes, applied the yml definitions to create the deployment, configmaps, service and ingress resources. Once the components are running, need to forward a local port to the ingress controller as shown below.</p>
<pre><code>kubectl port-forward --namespace=ingress-nginx service/ingress-nginx-controller 8080:80
</code></pre>
<p>Now, i can see the IP address assigned to my ingress resource as shown below.</p>
<pre><code>kubeadmin@kubemaster:~$ kubectl get ingress
NAME    CLASS   HOSTS              ADDRESS           PORTS   AGE
nginx   nginx   demo.localdev.me   192.168.122.198   80      75m
</code></pre>
<p>Launch the application using &quot;http://demo.localdev.me:8080&quot; which internally route to the ingress controller on port 80. Then the request routes to service backend which is keycloak which authenticates the request and routes back to the application.</p>
