Configure TLS on Bitnami Keycloak Helm Chart - keycloak

Question

Lots of effort... lack of success.
I'm trying to configure an external generated SSL Certificate. My objective is to use helm in order to manage the certificate. I'm using Bitnami's Keycloak Helm chart for deployment purposes on AKS.
Following is an excerpt of the helm chart definition - only the ingress declaration part:
## Keycloak ingress parameters
## ref: https://kubernetes.io/docs/user-guide/ingress/
##
ingress:
## #param ingress.enabled Enable ingress record generation for Keycloak
##
enabled: true
## #param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
##
ingressClassName: "nginx"
## #param ingress.pathType Ingress path type
##
pathType: ImplementationSpecific
## #param ingress.apiVersion Force Ingress API version (automatically detected if not set)
##
apiVersion: ""
## #param ingress.hostname Default host for the ingress record
##
hostname: "auth.sampledomain.com"
## #param ingress.path Default path for the ingress record
##
path: /
## #param ingress.servicePort Backend service port to use
## Default is http. Alternative is https.
##
servicePort: http
## #param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
## Use this parameter to set the required annotations for cert-manager, see
## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
## e.g:
## annotations:
## kubernetes.io/ingress.class: nginx
## cert-manager.io/cluster-issuer: cluster-issuer-name
##
annotations:
{
"nginx.ingress.kubernetes.io/client-header-buffer-size": "64k",
"nginx.ingress.kubernetes.io/force-ssl-redirect": "true",
"nginx.ingress.kubernetes.io/http2-max-field-size": "16k",
"nginx.ingress.kubernetes.io/http2-max-header-size": "128k",
"nginx.ingress.kubernetes.io/large-client-header-buffers": "8 64k",
"nginx.ingress.kubernetes.io/proxy-body-size": "4m",
"nginx.ingress.kubernetes.io/proxy-buffer-size": "128k",
"nginx.ingress.kubernetes.io/proxy-buffers": "4 256k",
"nginx.ingress.kubernetes.io/proxy-busy-buffers-size": "256k",
"nginx.ingress.kubernetes.io/secure-backends": "true",
"nginx.ingress.kubernetes.io/ssl-redirect": "true"
}
## #param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter
## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`
## You can:
## - Use the `ingress.secrets` parameter to create this TLS secret
## - Relay on cert-manager to create it by setting the corresponding annotations
## - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
##
tls: true
## #param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
##
selfSigned: false
## #param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record
## e.g:
## extraHosts:
## - name: keycloak.local
## path: /
##
extraHosts: []
## #param ingress.extraPaths Any additional arbitrary paths that may need to be added to the ingress under the main host.
## For example: The ALB ingress controller requires a special rule for handling SSL redirection.
## extraPaths:
## - path: /*
## backend:
## serviceName: ssl-redirect
## servicePort: use-annotation
##
extraPaths: []
## #param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.
## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
## extraTls:
## - hosts:
## - keycloak.local
## secretName: keycloak.local-tls
##
extraTls: []
## #param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets
## key and certificate should start with -----BEGIN CERTIFICATE----- or
## -----BEGIN RSA PRIVATE KEY-----
##
## name should line up with a tlsSecret set further up
## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set
##
## It is also possible to create and manage the certificates outside of this helm chart
## Please see README.md for more information
## e.g:
## - name: keycloak.local-tls
## key:
## certificate:
##
secrets:
[
{
"certificate": "-----BEGIN CERTIFICATE-----
djlkasjdlkasjdlksajdlksajdljaslkdjaslkdjaskldjlkasjdlkasjdlkasjd
djlkasjdlkasjdlksajdlksajdljaslkdjaslkdjaskldjlkasjdlkasjdlkasjd
.......
.......
hdjkashdjksahdkjsahdjkhsajkdhsajkdhsakjdhjksahdjhd= -----END CERTIFICATE----- ",
"key": "-----BEGIN RSA PRIVATE KEY-----
djlkasjdlkasjdlksajdlksajdljaslkdjaslkdjaskldjlkasjdlkasjdlkasjd
djlkasjdlkasjdlksajdlksajdljaslkdjaslkdjaskldjlkasjdlkasjdlkasjd
.......
.......
hdjkashdjksahdkjsahdjkhsajkdhsajkdhsakjdhjksahdjhd= -----END RSA
PRIVATE KEY-----",
"name": "aks-ingress-tls"
}
]
This is the generated ingress:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
meta.helm.sh/release-name: keycloak
meta.helm.sh/release-namespace: keycloak
nginx.ingress.kubernetes.io/client-header-buffer-size: 64k
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/http2-max-field-size: 16k
nginx.ingress.kubernetes.io/http2-max-header-size: 128k
nginx.ingress.kubernetes.io/large-client-header-buffers: 8 64k
nginx.ingress.kubernetes.io/proxy-body-size: 4m
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
nginx.ingress.kubernetes.io/proxy-buffers: 4 256k
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: 256k
nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
creationTimestamp: "2022-04-21T16:35:25Z"
generation: 7
labels:
app.kubernetes.io/component: keycloak
app.kubernetes.io/instance: keycloak
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: keycloak
helm.sh/chart: keycloak-7.1.16
name: keycloak
namespace: keycloak
resourceVersion: "6267339"
uid: 0238426d-3562-44ae-a6e6-34be825fbb30
spec:
ingressClassName: nginx
rules:
- host: auth.sampledomain.com
http:
paths:
- backend:
service:
name: keycloak
port:
name: http
path: /
pathType: ImplementationSpecific
tls:
- hosts:
- auth.sampledomain.com
secretName: aks-ingress-tls
status:
loadBalancer:
ingress:
- ip: 1.1.1.1
I had to add the TLS configuration on the ingress by myself.
For some reason the webapp is not secured..
What am I doing wrong here?

Answer 1

You need to configure the following in the bitnami helm chart :
## HTTPS settings
## ref: https://github.com/bitnami/containers/tree/main/bitnami/keycloak#tls-encryption
##
tls:
## #param tls.enabled Enable TLS encryption. Required for HTTPs traffic.
##
enabled: true
## #param tls.autoGenerated Generate automatically self-signed TLS certificates. Currently only supports PEM certificates
##
autoGenerated: true