Skip to content

Conversation

hpdvanwyk
Copy link

This is useful for overriding the backend of certain paths to not go to Keycloak.
One use case is when using Keycloak with the https://github.com/aerogear/keycloak-metrics-spi plugin along with aws-load-balancer-controller. This allow using the "alb.ingress.kubernetes.io/actions.${action-name}" annotation to make in-realm metrics endpoints 404 instead of exposing them on the public internet. This would otherwise be annoying to achieve since this plugin puts metrics on <base url>/realms/<realm>/metrics.

For example this allows creating the following ingress object which will 404 on all /realms//metrics paths while allowing everything else under /realms/:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: release-name-keycloakx
  namespace: default
  annotations:
    alb.ingress.kubernetes.io/actions.response-metrics: "{\"type\":\"fixed-response\",\"fixedResponseConfig\":{\"statusCode\":\"404\"}}\n"
spec:
  ingressClassName: alb
  tls:
    - hosts:
        - "${host}"
  rules:
    - host: "${host}"
      http:
        paths:
          - path: "/auth/realms/*/metrics"
            pathType: ImplementationSpecific
            backend:
              service:
                name: response-metrics
                port:
                  name: use-annotation
          - path: "/auth/realms/*"
            pathType: ImplementationSpecific
            backend:
              service:
                name: release-name-keycloakx-http
                port:
                  name: http

with the values.yaml snippet:

  rules:
    - host: "${host}"
      paths:
        - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/realms/*/metrics'
          pathType: ImplementationSpecific
          backendOverride:
            name: response-metrics
            port: use-annotation
        - path: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/realms/*'
          pathType: ImplementationSpecific

This is useful for overriding the backend of certain paths to not go to Keycloak.
One use case is when using aws-load-balancer-controller this can be used along
with the "alb.ingress.kubernetes.io/actions.${action-name}" annotation to make
in-realm metrics endpoints 404 instead of exposing them on the public internet.

Signed-off-by: Hendrik van Wyk <[email protected]>
@hpdvanwyk hpdvanwyk requested a review from a team as a code owner December 4, 2024 13:25
@stefangries
Copy link
Collaborator

Thank you for your contribution. Please adjust the naming of the variables so that they match the naming conventions of this chart.

Features are switched on via .enabled, for example. Please also add the default value ‘false’, so that we remain backward compatible.

Copy link

github-actions bot commented Apr 4, 2025

This pull request has been marked as stale because it has been open for 30 days with no activity. It will be automatically closed in 10 days if no further activity occurs.

@github-actions github-actions bot added the Stale label Apr 4, 2025
@github-actions github-actions bot closed this Apr 14, 2025
@stefangries stefangries reopened this Aug 11, 2025
@stefangries
Copy link
Collaborator

@hpdvanwyk Still interested in getting this merged? Please see my previous comment :-)

@github-actions github-actions bot removed the Stale label Aug 14, 2025
Copy link

This pull request has been marked as stale because it has been open for 30 days with no activity. It will be automatically closed in 10 days if no further activity occurs.

@github-actions github-actions bot added the Stale label Oct 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants