EKS集群中Keycloak管理控制台无限加载问题求助

问题背景 #

在EKS集群中部署Keycloak 19.0.1，已从开发模式切换为生产模式，通过AWS ALB实现SSL终止，但访问https://auth.identione.com/auth/admin时登录页面无限加载。

当前配置信息 #

Dockerfile #

FROM --platform=linux/arm64 quay.io/keycloak/keycloak:19.0.1 as builder

ENV KC_DB=postgres
ENV KC_PROXY=edge
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange
ENV KC_HTTP_RELATIVE_PATH=/auth
RUN /opt/keycloak/bin/kc.sh build

FROM --platform=linux/arm64 quay.io/keycloak/keycloak:19.0.1
COPY --from=builder /opt/keycloak/ /opt/keycloak/

## Install custom providers
COPY auth-identione-extension/target/auth-identione-extension-1.0.0-SNAPSHOT.jar /opt/keycloak/providers

ENV KC_HOSTNAME_STRICT=false
ENV KC_KEYCLOAK_USER={user}
ENV KC_KEYCLOAK_PASSWORD={password}
ENV KC_DB_URL={dburl}
ENV KC_DB_USERNAME={dbusername}
ENV KC_DB_PASSWORD={dbpassword}
ENV KC_HTTP_ENABLED=true
ENV KC_HOSTNAME=auth.identione.com
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized"]

deployment.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: default
  name: keycloak-deployment
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: keycloak-app
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: keycloak-app
    spec:
      containers:
        - image: {keycloak-img-url}
          name: keycloak-app
          resources:
            requests:
              memory: "512Mi"
              cpu: "500m"
            limits:
              memory: "1024Mi"
              cpu: "1000m"
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080

service.yaml #

apiVersion: v1
kind: Service
metadata:
  namespace: default
  name: keycloak-service
spec:
  ports:
    - port: 8180
      targetPort: 8080
      protocol: TCP
  type: NodePort
  selector:
    app.kubernetes.io/name: keycloak-app

ingress.yaml #

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  namespace: default
  name: keycloak-service-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: {certificate-arn}
    alb.ingress.kubernetes.io/ssl-redirect: 'https'
spec:
  rules:
    - host: auth.identione.com
      http:
        paths:
          - path: /*
            backend:
              serviceName: keycloak-service
              servicePort: 8180

问题分析与解决方案 #

1. 修正Ingress路径匹配规则 #

当前Ingress使用path: /*会导致Keycloak静态资源路径解析异常，需调整为精准匹配前缀并添加路径重写：

修改ingress.yaml的spec.rules.http.paths部分，并新增路径重写注解：

metadata:
  annotations:
    # 新增路径重写配置
    alb.ingress.kubernetes.io/rewrite-target: /auth/$2
    alb.ingress.kubernetes.io/conditions.auth.identione.com: |
      [{"field":"path-pattern","pathPatternConfig":{"values":["/auth/*"]}}]
spec:
  rules:
    - host: auth.identione.com
      http:
        paths:
          - path: /auth/*
            backend:
              serviceName: keycloak-service
              servicePort: 8180

2. 确保代理头正确传递 #

Keycloak在edge模式下依赖反向代理传递X-Forwarded-*头来识别外部请求协议与主机名，需在ALB注解中补充配置：

alb.ingress.kubernetes.io/backend-protocol: HTTP
alb.ingress.kubernetes.io/headers: |
  {
    "X-Forwarded-Proto": ["https"],
    "X-Forwarded-Host": ["auth.identione.com"]
  }

3. 优化Keycloak路径配置 #

在Dockerfile中新增KC_HOSTNAME_PATH环境变量，明确主机名对应的路径：

ENV KC_HOSTNAME_PATH=/auth

4. 排查自定义扩展兼容性 #

临时移除自定义扩展auth-identione-extension，重启Keycloak测试页面是否恢复正常，排除扩展版本不兼容问题。

5. 资源与日志排查 #

• 临时调高Keycloak容器资源限制，避免资源不足导致加载缓慢：

  resources:
    requests:
      memory: "1024Mi"
      cpu: "1000m"
    limits:
      memory: "2048Mi"
      cpu: "2000m"
  

• 查看容器日志定位具体错误：

  kubectl logs -f $(kubectl get pods -l app.kubernetes.io/name=keycloak-app -o jsonpath='{.items[0].metadata.name}')
  

验证步骤 #

1. 应用修改后的配置：

   kubectl apply -f ingress.yaml
   kubectl rollout restart deployment keycloak-deployment
   

2. 等待部署完成后，访问https://auth.identione.com/auth/admin测试登录页面是否正常加载。

内容的提问来源于stack exchange，提问作者user3677636