我已经向keycloft添加了一个领域，并在其值中更改了keycloft basepath=app1/auth。在helm图表的yaml中，但Keycloft会自动将任何发送到http://<internal ip address>:<internal port>/的请求重定向到http://<internal ip address>:<internal port/auth>。我希望它重定向到http://<internal ip address>:<internal port/app1/auth>，但同样的情况没有发生。我试过将ingress.path保持为空，并将app1/auth都保持为空。但这也不起作用。我见过有人报道这个问题，但我在任何地方都找不到解决方案。有人能告诉我如何解决这个问题吗？以下是我的价值。yaml
init:
image:
repository: busybox
tag: 1.31
pullPolicy: IfNotPresent
resources: {}
# limits:
# cpu: "10m"
# memory: "32Mi"
# requests:
# cpu: "10m"
# memory: "32Mi"
clusterDomain: cluster.local
## Optionally override the fully qualified name
# fullnameOverride: keycloak
## Optionally override the name
# nameOverride: keycloak
keycloak:
fullnameOverride: app1
replicas: 1
image:
repository: repo1
tag: 1.0.0
pullPolicy: Always
## Optionally specify an array of imagePullSecrets.
## Secrets must be manually created in the namespace.
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
##
pullSecrets: []
# - myRegistrKeySecretName
hostAliases: []
# - ip: "1.2.3.4"
# hostnames:
# - "my.host.com"
enableServiceLinks: false
restartPolicy: Always
serviceAccount:
# Specifies whether a service account should be created
create: false
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name:
securityContext:
fsGroup: 1000
containerSecurityContext:
runAsUser: 1000
runAsNonRoot: true
## The path keycloak will be served from. To serve keycloak from the root path, use two quotes (e.g. "").
basepath: app1/auth
## Additional init containers, e. g. for providing custom themes
extraInitContainers: |
## Additional sidecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy
extraContainers: |
## lifecycleHooks defines the container lifecycle hooks
lifecycleHooks: |
# postStart:
# exec:
# command: ["/bin/sh", "-c", "ls"]
## Additional arguments to start command e.g. -Dkeycloak.import= to load a realm
extraArgs: -Dkeycloak.import=/opt/jboss/keycloak/realm/realm-app1.json
## Username for the initial Keycloak admin user
username: admin
## Password for the initial Keycloak admin user. Applicable only if existingSecret is not set.
## If not set, a random 10 characters password will be used
password: password
# Specifies an existing secret to be used for the admin password
existingSecret: ""
# The key in the existing secret that stores the password
existingSecretKey: ""
## jGroups configuration (only for HA deployment)
jgroups:
discoveryProtocol: dns.DNS_PING
discoveryProperties: >
"dns_query={{ template "keycloak.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
## Allows the specification of additional environment variables for Keycloak
extraEnv: |
- name: PROXY_ADDRESS_FORWARDING
value: "true"
# - name: KEYCLOAK_LOGLEVEL
# value: DEBUG
# - name: WILDFLY_LOGLEVEL
# value: DEBUG
# - name: CACHE_OWNERS
# value: "2"
# - name: DB_QUERY_TIMEOUT
# value: "60"
# - name: DB_VALIDATE_ON_MATCH
# value: true
# - name: DB_USE_CAST_FAIL
# value: false
affinity: |
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
{{- include "keycloak.selectorLabels" . | nindent 10 }}
matchExpressions:
- key: role
operator: NotIn
values:
- test
topologyKey: kubernetes.io/hostname
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchLabels:
{{- include "keycloak.selectorLabels" . | nindent 12 }}
matchExpressions:
- key: role
operator: NotIn
values:
- test
topologyKey: failure-domain.beta.kubernetes.io/zone
nodeSelector: {}
priorityClassName: ""
tolerations: []
## Additional pod labels
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
podLabels: {}
## Extra Annotations to be added to pod
podAnnotations: {}
livenessProbe: |
httpGet:
path: {{ if ne .Values.keycloak.basepath "" }}/{{ .Values.keycloak.basepath }}{{ end }}/
port: http
initialDelaySeconds: 300
timeoutSeconds: 5
readinessProbe: |
httpGet:
path: {{ if ne .Values.keycloak.basepath "" }}/{{ .Values.keycloak.basepath }}{{ end }}/realms/master
port: http
initialDelaySeconds: 30
timeoutSeconds: 1
resources: {}
# limits:
# cpu: "100m"
# memory: "1024Mi"
# requests:
# cpu: "100m"
# memory: "1024Mi"
## WildFly CLI configurations. They all end up in the file 'keycloak.cli' configured in the configmap which is
## executed on server startup.
cli:
enabled: true
nodeIdentifier: |
{{ .Files.Get "scripts/node-identifier.cli" }}
logging: |
{{ .Files.Get "scripts/logging.cli" }}
ha: |
{{ .Files.Get "scripts/ha.cli" }}
datasource: |
{{ .Files.Get "scripts/datasource.cli" }}
# Custom CLI script
custom: |
## Custom startup scripts to run before Keycloak starts up
startupScripts: {}
# mystartup.sh: |
# #!/bin/sh
#
# echo 'Hello from my custom startup script!'
## Add additional volumes and mounts, e. g. for custom themes
extraVolumes: |
extraVolumeMounts: |
## Add additional ports, eg. for custom admin console
extraPorts: |
podDisruptionBudget: {}
# maxUnavailable: 1
# minAvailable: 1
service:
annotations: {}
# service.beta.kubernetes.io/aws-load-balancer-internal: "0.0.0.0/0"
labels: {}
# key: value
## ServiceType
## ref: https://kubernetes.io/docs/user-guide/services/#publishing-services---service-types
type: NodePort
## Optional static port assignment for service type NodePort.
# nodePort: 30000
httpPort: 8285
httpNodePort: 30024
httpsPort: 8443
httpsNodePort: ""
# Optional: jGroups port for high availability clustering
jgroupsPort: 7600
## Ingress configuration.
## ref: https://kubernetes.io/docs/user-guide/ingress/
ingress:
enabled: false
path: /app1/auth
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
# ingress.kubernetes.io/affinity: cookie
labels: {}
# key: value
## List of hosts for the ingress
hosts:
- keycloak.example.com
## TLS configuration
tls: []
# - hosts:
# - keycloak.example.com
# secretName: tls-keycloak
## OpenShift route configuration.
## ref: https://docs.openshift.com/container-platform/3.11/architecture/networking/routes.html
route:
enabled: false
path: /
annotations: {}
# kubernetes.io/tls-acme: "true"
# haproxy.router.openshift.io/disable_cookies: "true"
# haproxy.router.openshift.io/balance: roundrobin
labels: {}
# key: value
# Host name for the route
host:
# TLS configuration
tls:
enabled: true
insecureEdgeTerminationPolicy: Redirect
termination: edge
## Persistence configuration
persistence:
# If true, the Postgres chart is deployed
deployPostgres: false
# The database vendor. Can be either "postgres", "mysql", "mariadb", or "h2"
dbVendor: h2
## The following values only apply if "deployPostgres" is set to "false"
dbName: keycloak
dbHost: mykeycloak
dbPort: 5432
## Database Credentials are loaded from a Secret residing in the same Namespace as keycloak.
## The Chart can read credentials from an existing Secret OR it can provision its own Secret.
## Specify existing Secret
# If set, specifies the Name of an existing Secret to read db credentials from.
existingSecret: ""
existingSecretPasswordKey: "" # read keycloak db password from existingSecret under this Key
existingSecretUsernameKey: "" # read keycloak db user from existingSecret under this Key
## Provision new Secret
# Only used if existingSecret is not specified. In this case a new secret is created
# populated by the variables below.
dbUser: keycloak
dbPassword: ""
postgresql:
### PostgreSQL User to create.
##
postgresqlUsername: keycloak
## PostgreSQL Password for the new user.
## If not set, a random 10 characters password will be used.
##
postgresqlPassword: ""
## PostgreSQL Database to create.
##
postgresqlDatabase: keycloak
## Persistent Volume Storage configuration.
## ref: https://kubernetes.io/docs/user-guide/persistent-volumes
##
persistence:
## Enable PostgreSQL persistence using Persistent Volume Claims.
##
enabled: false
test:
enabled: false
image:
repository: unguiculus/docker-python3-phantomjs-selenium
tag: v1
pullPolicy: IfNotPresent
securityContext:
fsGroup: 1000
containerSecurityContext:
runAsUser: 1000
runAsNonRoot: true
prometheus:
operator:
## Are you using Prometheus Operator?
enabled: false
serviceMonitor:
## Additional labels to add to the ServiceMonitor so it is picked up by the operator.
## If using the [Helm Chart](https://github.com/helm/charts/tree/master/stable/prometheus-operator) this is the name of the Helm release.
selector:
release: prometheus
## Interval at which Prometheus scrapes metrics
interval: 10s
## Timeout at which Prometheus timeouts scrape run
scrapeTimeout: 10s
## The path to scrape
path: /auth/realms/master/metrics
prometheusRules:
## Add Prometheus Rules?
enabled: false
## Additional labels to add to the PrometheusRule so it is picked up by the operator.
## If using the [Helm Chart](https://github.com/helm/charts/tree/master/stable/prometheus-operator) this is the name of the Helm release and 'app: prometheus-operator'
selector:
app: prometheus-operator
release: prometheus
## Some example rules.
rules: {}
# - alert: keycloak-IngressHigh5xxRate
# annotations:
# message: The percentage of 5xx errors for keycloak over the last 5 minutes is over 1%.
# expr: (sum(rate(nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak",status=~"5[0-9]{2}"}[1m]))/sum(rate(nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak"}[1m])))*100 > 1
# for: 5m
# labels:
# severity: warning
# - alert: keycloak-IngressHigh5xxRate
# annotations:
# message: The percentage of 5xx errors for keycloak over the last 5 minutes is over 5%.
# expr: (sum(rate(nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak",status=~"5[0-9]{2}"}[1m]))/sum(rate(nginx_ingress_controller_response_duration_seconds_count{exported_namespace="mynamespace",ingress="mynamespace-keycloak"}[1m])))*100 > 5
# for: 5m
# labels:
# severity: critical
听起来您需要更新Keycloft的上下文路径。
它超级神秘，超级晦涩，很难在文档中找到，我不知道他们为什么决定让它变得如此困难。
以下是文档链接：https://artifacthub.io/packages/helm/codecentric/keycloak#changing-上下文路径
本质上有三件事你需要改变：
- 应用程序的上下文路径，用于生成重定向URL
- 活性探针
- 准备就绪探测器
这是您需要添加的相关YAML的副本，取自文档：
contextPath: mycontext
startupScripts:
# cli script that reconfigures WildFly
contextPath.cli: |
embed-server --server-config=standalone-ha.xml --std-out=echo
batch
{{- if ne .Values.contextPath "auth" }}
/subsystem=keycloak-server/:write-attribute(name=web-context,value={{ if eq .Values.contextPath "" }}/{{ else }}{{ .Values.contextPath }}{{ end }})
{{- if eq .Values.contextPath "" }}
/subsystem=undertow/server=default-server/host=default-host:write-attribute(name=default-web-module,value=keycloak-server.war)
{{- end }}
{{- end }}
run-batch
stop-embedded-server
livenessProbe: |
httpGet:
path: {{ if ne .Values.contextPath "" }}/{{ .Values.contextPath }}{{ end }}/
port: http
initialDelaySeconds: 300
timeoutSeconds: 5
readinessProbe: |
httpGet:
path: {{ if ne .Values.contextPath "" }}/{{ .Values.contextPath }}{{ end }}/realms/master
port: http
initialDelaySeconds: 30
timeoutSeconds: 1