<p>I use an <code>HAProxy</code> to redirect all requests from 80 port to a 443 and using a NodePort to enter on a <code>traefik-ingress-controller</code> (v1.6.6, inside a Kubernetes cluster).</p>

<p>Here the <code>HAProxy.conf</code>:</p>

<pre><code>frontend http-frontend                                                                                                               
       bind *:80                                                                                                                     
       reqadd X-Forwarded-Proto:\ http                                                                                               
       default_backend http_app                                                                                                      

frontend https-frontend                                                                                                             
        bind *:443 ssl crt /etc/ssl/certs/my-cert.pem                                                                   
        reqadd X-Forwarded-Proto:\ https                                                                                            
        default_backend traefik_app                                                                                                 

backend http_app                                                                                                                    
    redirect scheme https if !{ ssl_fc }                                                                                        

backend traefik_app                                                                                                             
    server traefik localhost:30010 check
</code></pre>

<p>Every application running on my Kubernetes cluster has an Ingress.</p>

<p>Among them I have a Keycloak pod (v4.1.0, for the authentication) with this ingress:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: keycloak
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  rules:
  - host: login.myapp.it
    http:
      paths:
      - backend:
          serviceName: keycloak
          servicePort: 8080
</code></pre>

<p>Here a picture:</p>

<p><a href="https://i.stack.imgur.com/VMyve.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VMyve.png" alt="enter image description here"></a></p>

<p>When I connect to <a href="https://login.myapp.it/auth/admin/" rel="nofollow noreferrer">https://login.myapp.it/auth/admin/</a> I get redirected to
<a href="https://login.myapp.it:80/auth/admin/master/console/" rel="nofollow noreferrer">https://login.myapp.it:80/auth/admin/master/console/</a> (note the port 80) and I received an <code>SSL_ERROR_RX_RECORD_TOO_LONG</code> error.</p>

<p>Someone has some hints for this redirect issue with keycloak behind proxy?</p>

<p>Thank you in advance.</p>

Nicola Ben
<p>Sounds like you are missing your TLS certs on your ingress:</p>

<pre><code>$ kubectl -n kube-system create secret tls your-k8s-tls-secret --key=tls.key --cert=tls.crt
</code></pre>

<p>Then: </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: keycloak
  annotations:
    kubernetes.io/ingress.class: traefik
spec:
  tls:
  - secretName: your-k8s-tls-secret
  rules:
  - host: login.myapp.it
    http:
      paths:
      - backend:
          serviceName: keycloak
          servicePort: 8080
</code></pre>

<p>Hope it helps!</p>
