AKS部署Keycloak 13.0.1.2无法通过Ingress访问管理路径

我在AKS中部署了2副本的Keycloak 13.0.1.2实例，Pod本身运行正常，通过port-forward直接连接Pod可以正常访问页面，但通过Ingress访问服务时返回404 - Not Found错误。

Service配置 #

apiVersion: v1
kind: Service
metadata:
  name: keycloak
  namespace: default
spec:
  ports:
    - port: 8080
      targetPort: 8080
      name: "http"
    - port: 8443
      targetPort: 8443
      name: "https"
  clusterIP: None
  selector:
    app: keycloak

Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keycloak
  labels:
    app: keycloak
spec:
  replicas: 2
  selector:
    matchLabels:
      app: keycloak
  template:
    metadata:
      labels:
        app: keycloak
    spec:
      containers:
        - name: keycloak
          image: openremote/keycloak:13.0.1.2
          env:
            - name: DB_ADDR
              value: "my-db-addr"
            - name: DB_DATABASE
              value: "my-db"
            - name: DB_PASSWORD
              value: "my-pass"
            - name: DB_SCHEMA
              value: "public"
            - name: DB_USER
              value: "my-db"
            - name: DB_VENDOR
              value: "POSTGRES"
            - name: KEYCLOAK_ADMIN
              value: "my-admin"
            - name: KEYCLOAK_ADMIN_PASSWORD
              value: "my-pass"
            - name: KEYCLOAK_HOSTNAME
              value: "my-url"
            - name: PROXY_ADDRESS_FORWARDING
              value: "true"
            - name: KC_HTTPS_CERTIFICATE_FILE
              value: "/etc/x509/https/tls.crt"
            - name: KC_HTTPS_CERTIFICATE_KEY_FILE
              value: "/etc/x509/https/tls.key"
            - name: KC_PROXY
              value: "edge"
            - name: KC_EXTRA_ARGS
              value: "--proxy edge"
            - name: KC_HOSTNAME_PATH
              value: "/auth"
            - name: KC_LOG_LEVEL
              value: DEBUG
          volumeMounts:
            - name: certs
              mountPath: /etc/x509/https
          ports:
            - name: https
              containerPort: 8443
      nodeSelector:
        agentpool: infra
      volumes:
      - name: certs
        secret:
          secretName:  keycloak-cert

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffer-size: 256k
    cert-manager.io/cluster-issuer: letsencrypt-infra
    nginx.ingress.kubernetes.io/backend-protocol: "https"
    nginx.ingkress.kubernetes.io/rewrite-target: "/auth"
spec:
  ingressClassName: infra-nginx
  tls:
  - hosts:
    - my-url #Use your domain
    secretName: keycloak-cert
  rules:
  - host: my-host
    http:
      paths:
      - path: /keycloak
        pathType: Prefix
        backend:
          service:
            name: keycloak
            port:
              number: 8443

Ingress控制器日志 #

151.68.55.116 - - [20/Nov/2024:17:00:54 +0000] "GET /keycloak HTTP/2.0" 404 74 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0" 319 0.019 [default-keycloak-8443] [] 10.30.1.167:8443 74 0.018 404 29536c909757e4bb635e12a039845677

日志显示请求已转发到Keycloak Pod（10.30.1.167:8443是其中一个Pod的IP），但仍返回404。

已尝试的修改 #

我修改了Deployment中的环境变量：

- name: KC_HOSTNAME_PATH
   value: "/keycloak"

并移除了Ingress中的nginx.ingress.kubernetes.io/rewrite-target: "/auth"注解，但问题依旧，日志显示：

109.118.34.65 - - [21/Nov/2024:10:08:35 +0000] "GET /keycloak/ HTTP/2.0" 404 74 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
28 0.002 [default-keycloak-8443] [] 10.30.1.159:8443 74 0.002 404
074d1cd2cd891103599dfb262196d425

我也尝试过保留Ingress的rewrite-target为"/auth"，同时设置KC_HOSTNAME_PATH为"/auth"，但结果仍然是404错误。

内容的提问来源于stack exchange，提问作者Francesco Laudani