Kubernetes上Keycloak高可用集群登录控制台时出现ERR_TOO_MANY_REDIRECTS

当前环境组件：

• EKS集群
• 用于SSL终止的ALB反向代理
• 自定义主机名
• 基于Kubernetes CACHE_STACK的Infinispan缓存

单节点部署时可通过HTTPS正常访问，但副本数改为2后，登录管理控制台出现ERR_TOO_MANY_REDIRECTS错误。以下是配置文件：

Dockerfile #

FROM --platform=linux/arm64 quay.io/keycloak/keycloak:18.0.0 as builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange
ENV KC_DB=postgres
ENV KC_CACHE_STACK=kubernetes
## Install custom providers
COPY auth-identione-extension/target/auth-identione-extension-1.0.0-SNAPSHOT.jar /opt/keycloak/providers
RUN /opt/keycloak/bin/kc.sh build

FROM --platform=linux/arm64 quay.io/keycloak/keycloak:18.0.0
COPY --from=builder /opt/keycloak/ /opt/keycloak/

ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

Deployment配置（statefulset.yaml） #

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: default
  name: keycloak-deployment
spec:
  serviceName: keycloak-service
  selector:
    matchLabels:
      app.kubernetes.io/name: keycloak-app
  replicas: 2
  template:
    metadata:
      labels:
        app.kubernetes.io/name: keycloak-app
    spec:
      containers:
        - image: {myKeycloakImage}
          name: keycloak-app
          args: ["-Djgroups.dns.query=keycloak-service", "start"]
          env:
            - name: KC_HOSTNAME
              value: "auth.mydomain.com"
            - name: KC_HOSTNAME_STRICT_HTTPS
              value: "false"
            - name: KC_PROXY
              value: "edge"
            - name: KC_DB_URL
              value: {db-url}
            - name: KC_DB_USERNAME
              value: {db-username}
            - name: KC_DB_PASSWORD
              value: {db-password}
          resources:
            requests:
              memory: "512Mi"
              cpu: "500m"
            limits:
              memory: "1024Mi"
              cpu: "1000m"
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080

Service配置（service.yaml） #

apiVersion: v1
kind: Service
metadata:
  namespace: default
  name: keycloak-service
spec:
  ports:
    - port: 8180
      targetPort: 8080
      protocol: TCP
  type: NodePort
  selector:
    app.kubernetes.io/name: keycloak-app

Ingress配置（ingress.yaml） #

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: default
  name: keycloak-service-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: {certificateArn}
    alb.ingress.kubernetes.io/ssl-redirect: '443'
spec:
  rules:
    - host: auth.mydomain.com
      http:
        paths:
          - path: /*
            backend:
              serviceName: keycloak-service
              servicePort: 8180

重定向循环核心原因是多节点会话一致性缺失、代理协议信息传递错误，结合Keycloak 18特性，调整以下配置即可解决：

1. 配置会话亲和性与缓存同步 #

• 在Service中添加客户端IP会话亲和性，避免请求跨节点跳转丢失会话：

  spec:
    sessionAffinity: ClientIP
    sessionAffinityConfig:
      clientIP:
        timeoutSeconds: 10800
  

• 保留-Djgroups.dns.query=keycloak-service参数，确保JGroups通过Kubernetes DNS发现集群节点，完成Infinispan缓存同步。

2. 修正代理与主机名配置 #

当前KC_HOSTNAME_STRICT_HTTPS=false会导致Keycloak生成HTTP跳转链接，与ALB的HTTPS强制规则冲突，调整如下：

• 添加KC_EDGE_INSECURE_REQUESTS=redirect环境变量，确保Keycloak基于代理传递的协议生成正确的HTTPS跳转：

  env:
    - name: KC_EDGE_INSECURE_REQUESTS
      value: "redirect"
  

• ALB默认会传递X-Forwarded-Proto和X-Forwarded-Host头部，Keycloak在edge代理模式下会依赖这些头部识别外部请求协议，无需额外配置。

3. 清理无效配置 #

Deployment中serviceName是StatefulSet专属字段，需删除该无效配置：

spec:
  # 移除以下行
  # serviceName: keycloak-service

4. 验证集群通信 #

查看Pod日志确认JGroups集群通信正常：

kubectl logs -f <keycloak-pod-name> | grep JGRP

日志中应显示节点成功加入集群的信息，确保keycloak-service DNS解析正常。

完成以上调整后重新部署，多节点环境下的登录重定向问题即可解决。

内容的提问来源于stack exchange，提问作者user3677636