<p>I have successfully exposed two microservices on <strong>AWS</strong> with <strong>Traefik Ingress Controller</strong> and <strong>AWS HTTPS Load Balancer</strong> on my registered domain.</p>
<p>Here is the source code:
<a href="https://github.com/skyglass-examples/user-management-keycloak" rel="nofollow noreferrer">https://github.com/skyglass-examples/user-management-keycloak</a></p>
<p>I can easily access both microservices with https url:</p>
<pre><code>https://users.skycomposer.net/usermgmt/swagger-ui/index.html
https://users.skycomposer.net/whoami
</code></pre>
<p>So, it seems that <strong>Traefik Ingress Controller</strong> and <strong>AWS HTTPS Load Balancer</strong> configured correctly.</p>
<p>Unfortunately, <strong>Keycloak Server</strong> doesn't work in this environment.
When I try to access it by https url:</p>
<pre><code>https://users.skycomposer.net/keycloak
</code></pre>
<p>I receive the following response:</p>
<pre><code>404 page not found
</code></pre>
<p>Do I miss something in my configuration?</p>
<p>Here are some <strong>keycloak kubernetes manifests</strong>, which I use:</p>
<p><strong>keycloak-config.yaml:</strong></p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: keycloak
data:
  KEYCLOAK_USER: admin@keycloak
  KEYCLOAK_MGMT_USER: mgmt@keycloak
  JAVA_OPTS_APPEND: '-Djboss.bind.address.management=0.0.0.0'
  PROXY_ADDRESS_FORWARDING: 'true'
  KEYCLOAK_LOGLEVEL: INFO
  ROOT_LOGLEVEL: INFO
  DB_VENDOR: H2
</code></pre>
<p><strong>keycloak-deployment.yaml:</strong></p>
<pre><code>kind: Deployment
apiVersion: apps/v1
metadata:
  name: keycloak
  labels:
    app: keycloak

spec:
  replicas: 1
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
        - name: keycloak
          image: jboss/keycloak:12.0.4
          imagePullPolicy: Always
          ports:
            - containerPort: 9990
              hostPort: 9990
          volumeMounts:
            - name: keycloak-data
              mountPath: /opt/jboss/keycloak/standalone/data
          env:
            - name: KEYCLOAK_USER
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: KEYCLOAK_USER
            - name: KEYCLOAK_MGMT_USER
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: KEYCLOAK_MGMT_USER
            - name: JAVA_OPTS_APPEND
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: JAVA_OPTS_APPEND
            - name: DB_VENDOR
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: DB_VENDOR
            - name: PROXY_ADDRESS_FORWARDING
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: PROXY_ADDRESS_FORWARDING
            - name: KEYCLOAK_LOGLEVEL
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: KEYCLOAK_LOGLEVEL
            - name: ROOT_LOGLEVEL
              valueFrom:
                configMapKeyRef:
                  name: keycloak
                  key: ROOT_LOGLEVEL
            - name: KEYCLOAK_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: keycloak
                  key: KEYCLOAK_PASSWORD
            - name: KEYCLOAK_MGMT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: keycloak
                  key: KEYCLOAK_MGMT_PASSWORD
      volumes:
        - name: keycloak-data
          persistentVolumeClaim:
            claimName: keycloak-pvc
</code></pre>
<p><strong>keycloak-service.yaml:</strong></p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: keycloak

spec:
  ports:
    - protocol: TCP
      name: web
      port: 80
      targetPort: 9990
  selector:
    app: keycloak
</code></pre>
<p><strong>traefik-ingress.yaml:</strong></p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: IngressClass
metadata:
  name: traefik-lb
spec:
  controller: traefik.io/ingress-controller

---
apiVersion: &quot;networking.k8s.io/v1beta1&quot;
kind: &quot;Ingress&quot;
metadata:
  name: &quot;traefik-usermgmt-ingress&quot;
spec:
  ingressClassName: &quot;traefik-lb&quot;
  rules:
  - host: &quot;keycloak.skycomposer.net&quot;
    http:
      paths:
      - path: &quot;/usermgmt&quot;
        backend:
          serviceName: &quot;usermgmt&quot;
          servicePort: 80


---
apiVersion: &quot;networking.k8s.io/v1beta1&quot;
kind: &quot;Ingress&quot;
metadata:
  name: &quot;traefik-whoami-ingress&quot;
spec:
  ingressClassName: &quot;traefik-lb&quot;
  rules:
  - host: &quot;keycloak.skycomposer.net&quot;
    http:
      paths:
      - path: &quot;/whoami&quot;
        backend:
          serviceName: &quot;whoami&quot;
          servicePort: 80


---
apiVersion: &quot;networking.k8s.io/v1beta1&quot;
kind: &quot;Ingress&quot;
metadata:
  name: &quot;traefik-keycloak-ingress&quot;
spec:
  ingressClassName: &quot;traefik-lb&quot;
  rules:
  - host: &quot;keycloak.skycomposer.net&quot;
    http:
      paths:
      - path: &quot;/keycloak&quot;
        backend:
          serviceName: &quot;keycloak&quot;
          servicePort: 80
</code></pre>
<p>See all other files on my <strong>github</strong>: <a href="https://github.com/skyglass-examples/user-management-keycloak" rel="nofollow noreferrer">https://github.com/skyglass-examples/user-management-keycloak</a></p>
<p>I also checked the logs for keycloak pod, running on my K3S Kubernetes Cluster:</p>
<pre><code>20:57:34,147 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0025: Keycloak 12.0.4 (WildFly Core 13.0.3.Final) started in 43054ms - Started 687 of 972 services (687 services are lazy, passive or on-demand)
20:57:34,153 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http management interface listening on http://127.0.0.1:9990/management
20:57:34,153 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990
</code></pre>
<p>Everything seems to be fine, Admin console is listening on <a href="http://127.0.0.1:9990" rel="nofollow noreferrer">http://127.0.0.1:9990</a></p>
<p>I also tried using <strong>9990</strong> target port in deployment and service manifests, instead of <strong>8080</strong>, but still the same result.</p>

Mykhailo Skliar
<p>I have found one small workaround, but unfortunately, this is not the best solution for me.</p>
<p>I forwarded the port:</p>
<pre><code>kubectl port-forward --address 0.0.0.0 service/keycloak 32080:http
</code></pre>
<p>Now Keycloak Server is available on:</p>
<pre><code>http://localhost:32080/auth/
</code></pre>
<p>But how to make it available externally by this url ?</p>
<pre><code>https://keycloak.skycomposer.net/keycloak/auth
</code></pre>
<p>It is still not clear to me, why the keycloak is not visible from the outside, with my current configuration.</p>
