在 openshift 上为 keycloak 配置 TLS

Question

I want to configure SSL on keycloak deployment on openshift. I am using jboss/keycloak image for keycloak deployment which used latest keycloak version 4.6.final. But I read it somewhere that keycloak doesn't accept default TLS certificates available on openshift.

My purpose is to run the keycloak application on https on openshift. It works fine on http, but when I create the route with TLS enabled, it fails to run. I think I am missing some parameter somewhere in the deployment config.

Answer 1

You must configure in Openshift a route with reencrypt termination. In my case that was solving the problem.

You have from your frontend tot openshift router ssl en ssl from your router to your backend pod. That requires reencrypt termination.

In your route you have to define 4 certificates

tls certificate tls key ca certificate (your intermediate certificate) destination certifcate (the certificate you use on the keycloak pod)

For the desination certifcate I have used the certificate in my alpine pod in /etc/ssl/certs (ca-certifcates.crt)

More about reencrypt termination: https://docs.openshift.com/container-platform/4.7/networking/routes/secured-routes.html

Answer 2

In order to configure route with reencrypt termination:

oc create route reencrypt <NAME> --service=keycloak --port=keycloak --cert=<CERTIFICATEFILE>.crt --key=<KEYFILE>.key --hostname=sso.apps.company.lan