<p>I have found a strange behavior in Keycloak when deployed in Kubernetes, that I can't wrap my head around.</p>
<p>Use-case:</p>
<ul>
<li>login as admin:admin (created by default)</li>
<li>click on Manage account</li>
</ul>
<p>(<a href="https://i.stack.imgur.com/n3wuZ.png" rel="nofollow noreferrer">manage account dialog screenshot</a>)</p>
<p>I have compared how the (same) image (<strong>quay.io/keycloak/keycloak:17.0.0</strong>) behaves if it runs on Docker or in Kubernetes (K3S).</p>
<p>If I run it from Docker, the account console loads. In other terms, I get a success (<strong>204</strong>) for the request</p>
<p><code>GET /realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=account-console</code></p>
<p>From the same image deployed in Kubernetes, the same request fails with error <strong>403</strong>. However, on this same application, I get a success (<strong>204</strong>) for the request</p>
<p><code>GET /realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=security-admin-console</code></p>
<p>Since I can call security-admin-console, this does not look like an issue with the Kubernetes Ingress gateway nor with anything related to routing.</p>
<p>I've then thought about a Keycloak access-control configuration issue, but in both cases I use the default image without any change. I cross-checked to be sure, it appears that the admin user and the account-console client are configured exactly in the same way in both the docker and k8s applications.</p>
<p>I have no more idea about what could be the problem, do you have any suggestion?</p>

vlt
<p>Try to set <code>ssl_required = NONE</code> in <strong>realm</strong> table in Keycloak database to your realm (master)</p>
