title: ALB/Ingress to Keycloak SSL communication configuration
body: <p>I have some services running on the cluster, and the ALB is working fine. I want to configure SSL communication from ALB/ingress to Keycloak17.0.1 by creating a self signed certificate and establish a communication to route through port 8443 instead of http(80). Keycloak is being built by the docker image. Docker compose file is exposing the port 8443.I should also make sure to have the keystore defined as a Kubernetes PVC within the deployment instead of a docker volume.</p>
  <p>Below is deployment file:</p>
  <pre><code>---
  
  
  apiVersion: &quot;apps/v1&quot;
    kind: &quot;Deployment&quot;
    metadata: 
      name: &quot;keycloak&quot;
      namespace: &quot;test&quot;
    spec:
        volumes:
          - name: keycloak-pv-volume
            persistentVolumeClaim:
              claimName: keycloak-pv-claim
    spec: 
      selector: 
        matchLabels: 
          app: &quot;keycloak&quot;
      replicas: 3
      strategy: 
        type: &quot;RollingUpdate&quot;
        rollingUpdate: 
          maxSurge: 1
          maxUnavailable: 1
      minReadySeconds: 5
      template: 
        metadata: 
          labels: 
            app: &quot;keycloak&quot;
        spec: 
          containers: 
  
            - 
              name: &quot;keycloak&quot;
              image: &quot;quay.io/keycloak/keycloak:17.0.1&quot;
              imagePullPolicy: &quot;Always&quot;
  
              livenessProbe: 
                httpGet: 
                  path: /realms/master
                  port: 8080
                initialDelaySeconds: 5
                periodSeconds: 5
  
              readinessProbe: 
                tcpSocket: 
                  port: 8080 
                initialDelaySeconds: 300 
                periodSeconds: 30
  
              env: 
                - 
                  name: &quot;KEYCLOAK_USER&quot;
                  value: &quot;admin&quot;
  
                -
                  name: &quot;KEYCLOAK_PASSWORD&quot;
                  value: &quot;admin&quot;
  
                -
                  name: &quot;PROXY_ADDRESS_FORWARDING&quot;
                  value: &quot;true&quot;
                -
                  name: HTTPS_PROXY
                  value: &quot;https://engineering-exodos*********:3128&quot;
                -
                  name: KC_HIDE_REALM_IN_ISSUER
                  value:************
  
              ports: 
  
                - name: &quot;http&quot;
                  containerPort: 8080
  
                - name: &quot;https&quot;
                  containerPort: 8443 
  </code></pre>
  <p>self certificate is being created like below: (.groovy)</p>
  <p>def secretPatch = 'kc alb-secret-patch.yaml'
  sh loadMixins() + &quot;&quot;&quot;
  openssl req -newkey rsa:4096 <br />
  -x509 <br />
  -sha256 <br />
  -days 395 <br />
  -nodes <br />
  -out keycloak_alb.crt <br />
  -keyout keycloak_alb.key <br />
  -subj &quot;/C=US/ST=MN/L=MN/O=Security/OU=IT Department/CN=www.gateway.com&quot;
  EXISTS=$(kubectl -n istio-system get secret --ignore-not-found keycloak_alb-secret)
  if [ -z &quot;$EXISTS&quot; ]; then
  kubectl -n  create secret tls keycloak_alb-secret --key=&quot;keycloak_alb.key&quot; --cert=&quot;keycloak_alb.crt&quot;
  else
  # base64 needs the '-w0' flag to avoid wrapping long lines
  echo -e &quot;data:\n tls.key: $(base64 -w0 keycloak_alb.key)\n tls.crt: $(base64 -w0 keycloak.crt)&quot; &gt; ${secretPatch}
  kubectl -n istio-system patch secret keycloak_alb-secret -p &quot;$(cat ${secretPatch})&quot;
  fi
  &quot;&quot;&quot;
  }</p>
  <p>Docker file:</p>
  <pre><code>    FROM quay.io/keycloak/keycloak:17.0.1 as builder
  
  ENV KC_METRICS_ENABLED=true
  ENV KC_CACHE=ispn
  ENV KC_DB=postgres
  
  USER keycloak
  RUN chmod -R 755 /opt/keycloak \
      &amp;&amp; chown -R keycloak:keycloak /opt/keycloak
  
  COPY ./keycloak-benchmark-dataset.jar /opt/keycloak/providers/keycloak-benchmark-dataset.jar
  COPY ./ness-event-listener.jar /opt/keycloak/providers/ness-event-listener.jar
  # RUN curl -o /opt/keycloak/providers/ness-event-listener-17.0.0.jar https://repo1.uhc.com/artifactory/repo/com/optum/dis/keycloak/ness_event_listener/17.0.0/ness-event-listener-17.0.0.jar
  
  # Changes for hiding realm in issuer claim in access token
  COPY ./keycloak-services-17.0.1.jar /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-17.0.1.jar
  
  RUN /opt/keycloak/bin/kc.sh build`enter code here`
  
  FROM quay.io/keycloak/keycloak:17.0.1
  COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
  COPY --from=builder /opt/keycloak/providers /opt/keycloak/providers
  COPY --from=builder /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-17.0.1.jar /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-17.0.1.jar
  COPY --chown=keycloak:keycloak cache-ispn-remote.xml /opt/keycloak/conf/cache-ispn-remote.xml
  COPY conf /opt/keycloak/conf/
  
  # Elastic APM integration changes
  USER root
  RUN mkdir -p /opt/elastic/apm
  RUN chmod -R 755 /opt/elastic/apm
  RUN curl -L https://repo1.uhc.com/artifactory/Thirdparty-Snapshots/com/elastic/apm/agents/java/current/elastic-apm-agent.jar -o /opt/elastic/apm/elastic-apm-agent.jar
  
  ENV ES_AGENT=&quot; -javaagent:/opt/elastic/apm/elastic-apm-agent.jar&quot;
  ENV ELASTIC_APM_SERVICE_NAME=&quot;AIDE_007&quot;
  ENV ELASTIC_APM_SERVER_URL=&quot;https://nonprod.uhc.com:443&quot;
  ENV ELASTIC_APM_VERIFY_SERVER_CERT=&quot;false&quot;
  ENV ELASTIC_APM_ENABLED=&quot;true&quot;
  ENV ELASTIC_APM_LOG_LEVEL=&quot;WARN&quot;
  ENV ELASTIC_APM_ENVIRONMENT=&quot;Test-DIS&quot;
  
  CMD export JAVA_OPTS=&quot;$JAVA_OPTS $ES_AGENT&quot;
   
  USER keycloak
  ENTRYPOINT [&quot;/opt/keycloak/bin/kc.sh&quot;, &quot;start&quot;]
  </code></pre>
  <p>Docker Compose:
  services:</p>
  <pre><code> keycloak:
      image: quay.io/keycloak/keycloak:17.0.1
      command: start-dev
      environment:
        KEYCLOAK_ADMIN: admin
        KEYCLOAK_ADMIN_PASSWORD: admin
        KC_HTTPS_CERTIFICATE_FILE: /opt/keycloak/tls.crt
        KC_HTTPS_CERTIFICATE_KEY_FILE: /opt/keycloak/tls.key
      ports:
        - 8080:8080
        - 8443:8443
      volumes:
        - ./localhost.crt:/opt/keycloak/conf/tls.crt
        - ./localhost.key:/opt/keycloak/conf/tls.key
  </code></pre>
  <p>What is best standard way of practice to go ahead and route the traffic via SSL from ALB to Keycloak?</p>