如何解决部署在Okteto上的Keycloak混合内容问题？

我已将Keycloak实例部署至Okteto，地址为https://keycloak-jeff-tian.cloud.okteto.net/，使用的Dockerfile如下：

FROM quay.io/keycloak/keycloak:latest

COPY idps/wechat-mobile/keycloak-services-social-weixin.jar \
    /opt/keycloak/providers/
COPY idps/wechat-mobile/templates/realm-identity-provider-weixin-ext.html \
    /opt/keycloak/themes/base/admin/resources/partials
COPY idps/wechat-mobile/templates/realm-identity-provider-weixin.html \
    /opt/keycloak/themes/base/admin/resources/partials

COPY idps/wecom/keycloak-services-social-wechat-work.jar \
    /opt/keycloak/providers/
COPY idps/wecom/templates/realm-identity-provider-wechat-work.html \
    /opt/keycloak/themes/base/admin/resources/partials
COPY idps/wecom/templates/realm-identity-provider-wechat-work-ext.html \
    /opt/keycloak/themes/base/admin/resources/partials


#COPY  temp/* /opt/keycloak/themes/base/admin/resources/partials
#COPY  ui/font_iconfont /opt/keycloak/themes/keycloak/common/resources/lib/font_iconfont
#COPY  ui/theme.properties /opt/keycloak/themes/keycloak/login/
COPY  target/keycloak-justauth-12.0.1-jar-with-dependencies.jar /opt/keycloak/providers/

COPY  target/keycloak-justauth-12.0.1-jar-with-dependencies.jar /opt/keycloak/deployments/

ENV KC_HOSTNAME_STRICT=false
ENV KC_HOSTNAME_STRICT_HTTPS=false
ENV KC_HTTP_ENABLED=true
ENV PROXY_ADDRESS_FORWARDING=true
ENV FRONTEND_URL=https://keycloak-jeff-tian.cloud.okteto.net
ENV KC_HOSTNAME_URL=https://keycloak-jeff-tian.cloud.okteto.net

CMD ["start", "--proxy=passthrough", "--db=postgres", "--db-url=$DB_URL", "--db-username=$DB_USERNAME", "--db-password=$DB_PASSWORD", "--features=\"preview,scripts\""]

登录管理控制台后，页面因混合内容问题无法加载，期望所有请求URL以https://开头，可通过以下配置强制HTTPS：

调整环境变量与启动参数 #

1. 启用严格HTTPS模式 #

修改KC_HOSTNAME_STRICT_HTTPS为true，该参数会强制Keycloak生成的所有内部URL（包括控制台静态资源、API请求地址）使用HTTPS协议，从根源避免混合内容问题。

2. 可选：关闭HTTP监听端口 #

如果无需HTTP访问，设置KC_HTTP_ENABLED=false，彻底禁用HTTP端口，进一步确保所有流量走HTTPS。

3. 保留代理相关配置 #

保持PROXY_ADDRESS_FORWARDING=true和--proxy=passthrough参数，因为Okteto的反向代理会向Keycloak传递X-Forwarded-Proto等协议标识头，Keycloak需要这些信息来正确识别外部请求的协议类型。

修改后的关键配置片段 #

ENV KC_HOSTNAME_STRICT=false
ENV KC_HOSTNAME_STRICT_HTTPS=true
ENV KC_HTTP_ENABLED=false
ENV PROXY_ADDRESS_FORWARDING=true
ENV FRONTEND_URL=https://keycloak-jeff-tian.cloud.okteto.net
ENV KC_HOSTNAME_URL=https://keycloak-jeff-tian.cloud.okteto.net

CMD ["start", "--proxy=passthrough", "--db=postgres", "--db-url=$DB_URL", "--db-username=$DB_USERNAME", "--db-password=$DB_PASSWORD", "--features=\"preview,scripts\""]

完成上述修改后，重新构建镜像并部署，Keycloak管理控制台的所有资源请求都会使用HTTPS协议，混合内容问题即可解决。

内容的提问来源于stack exchange，提问作者Jeff Tian