Skip to content

Conversation

@HujinoKun
Copy link

Hello,

When managing certificates through ingress annotations, with the current version it is impossible to remove the default tls section on the Keycloak ingress.

In my case, I manage the certificate part through my Azure Application Gateway and its controller on AKS.

Bad output :

# Source: keycloakx/templates/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak
  namespace: default
  annotations:
    appgw.ingress.kubernetes.io/cookie-based-affinity: "true"
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: "cert-xx"
  labels:
    helm.sh/chart: keycloakx-7.1.4
    app.kubernetes.io/name: keycloakx
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/version: "26.4.2"
    app.kubernetes.io/managed-by: Helm
spec:
  ingressClassName: azure-application-gateway
  tls: <-- BAD : Default values
    - hosts:
        - "keycloak.example.com"
  rules:
    - host: "keycloak.domain.com"
      http:
        paths:
          - path: "/"
            pathType: Prefix
            backend:
              service:
                name: keycloak-http
                port:
                  name: http

Good output :

# Source: keycloakx/templates/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak
  namespace: default
  annotations:
    appgw.ingress.kubernetes.io/cookie-based-affinity: "true"
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: "cert-xx"
  labels:
    helm.sh/chart: keycloakx-7.1.4
    app.kubernetes.io/name: keycloakx
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/version: "26.4.2"
    app.kubernetes.io/managed-by: Helm
spec:
  ingressClassName: azure-application-gateway
  rules:
    - host: "keycloak.domain.com"
      http:
        paths:
          - path: "/"
            pathType: Prefix
            backend:
              service:
                name: keycloak-http
                port:
                  name: http

This fix allows us to completely bypass the tls section on ingress by removing the default values.

I also bumped the chart version by incrementing the number assigned to the fix, from 7.1.4 to 7.1.5.

@HujinoKun HujinoKun requested a review from a team as a code owner November 6, 2025 22:10
@HujinoKun HujinoKun force-pushed the master branch 3 times, most recently from ea9f8dc to ec81859 Compare November 6, 2025 22:19
@HujinoKun
Copy link
Author

@stefangries Hello,

Could you spare a few minutes for this PR?

@stefangries
Copy link
Collaborator

I'm fine with the changes. Please remove the version bump as we only bump versions once we release a new one and not with every pull request.

@HujinoKun
Copy link
Author

Hello @stefangries :)

I have just made the amend and rebase commands in order to remove the change to the Chart.yaml file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants