Setting up Ingress for Keycloak on Kubernetes with SSL termination

Question

Pulumi · Accepted Answer

To set up Ingress for Keycloak on Kubernetes with SSL termination, you will need to have several components in place:

1. **Keycloak Deployment**: This will be the running instance of Keycloak within your Kubernetes cluster.
2. **Service**: A Kubernetes Service resource to expose your Keycloak Deployment inside the cluster.
3. **Ingress Resource**: The Ingress resource will define rules to route external HTTP/S traffic to the Keycloak Service.
4. **TLS Secret**: A Kubernetes Secret resource to store the TLS certificate and private key for SSL termination at the Ingress level.

Below is a Pulumi program written in TypeScript that demonstrates how you can set up these components. The program assumes that you have already installed and configured the required Pulumi CLI and Kubernetes provider for your environment and that you have a domain name ready for Keycloak and an existing TLS certificate (and its corresponding private key) to use for SSL termination.

```typescript
import * as k8s from "@pulumi/kubernetes";

// Replace these with the actual domain name and certificate data.
const domainName = 'keycloak.yourdomain.com';
const tlsCertificate = '-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----';
const tlsPrivateKey = '-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----';

// Define a Secret for the TLS certificate. The certificate and key are used by the Ingress.
const tlsSecret = new k8s.core.v1.Secret("tls-secret", {
    metadata: {
        name: "tls-secret" // Name for the secret
    },
    type: "kubernetes.io/tls",
    data: {
        "tls.crt": Buffer.from(tlsCertificate).toString('base64'),
        "tls.key": Buffer.from(tlsPrivateKey).toString('base64'),
    },
});

// Deploy Keycloak using a Kubernetes Deployment.
const keycloakDeployment = new k8s.apps.v1.Deployment("keycloak-deployment", {
    spec: {
        selector: { matchLabels: { app: "keycloak" }},
        replicas: 1,
        template: {
            metadata: { labels: { app: "keycloak" }},
            spec: {
                containers: [{
                    name: "keycloak",
                    image: "jboss/keycloak",
                    env: [
                        { name: "KEYCLOAK_USER", value: "admin" }, // Set desired username
                        { name: "KEYCLOAK_PASSWORD", value: "password" }, // Set desired password
                        // Add other environment variables if needed.
                    ],
                    ports: [{ name: "http", containerPort: 8080 }],
                }],
            },
        },
    },
});

// Create a Service to expose the Keycloak Deployment within the cluster.
const keycloakService = new k8s.core.v1.Service("keycloak-service", {
    spec: {
        type: "ClusterIP",
        selector: keycloakDeployment.spec.template.metadata.labels,
        ports: [{ port: 8080, targetPort: "http" }],
    },
});

// Define an Ingress resource to expose Keycloak to the external network with SSL termination.
const keycloakIngress = new k8s.networking.v1.Ingress("keycloak-ingress", {
    metadata: {
        name: "keycloak-ingress",
    },
    spec: {
        tls: [{
            hosts: [domainName],
            secretName: tlsSecret.metadata.name,
        }],
        rules: [{
            host: domainName,
            http: {
                paths: [{
                    path: "/",
                    pathType: "Prefix",
                    backend: {
                        service: {
                            name: keycloakService.metadata.name,
                            port: {
                                number: 8080,
                            },
                        },
                    },
                }],
            },
        }],
    },
});

// Export the endpoint to access Keycloak
export const keycloakUrl = `https://${domainName}/`;
```

This Pulumi program performs the following actions:

1. **TLS Secret**: Creates a Kubernetes Secret to store your TLS certificate and private key.
2. **Keycloak Deployment**: It deploys Keycloak as a Deployment on your Kubernetes cluster using the image `jboss/keycloak`. The program specifies the Keycloak admin username and password through environment variables. You would replace the values with your desired credentials, and potentially add more environment variables as needed for your Keycloak setup.
3. **Service**: It exposes the Keycloak Deployment internally in the cluster via a Service on port 8080.
4. **Ingress**: Creates an Ingress resource which defines rules to route external HTTPS traffic to the Keycloak Service. It uses the TLS Secret for SSL termination, allowing secure connections to Keycloak.
   
The `keycloakUrl` export at the end of the program provides the URL through which you can access the Keycloak instance after the Ingress is set up.

Remember to replace `yourdomain.com` with your actual domain and also provide the correct certificate and private key for your domain in `tlsCertificate` and `tlsPrivateKey`. Also, ensure that you have a DNS record pointing your domain to the IP address allocated by the Ingress controller in your Kubernetes cluster.