Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: remove operator's usage of the proxy setting #31003

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pepo48 merged 1 commit into from
Jul 11, 2024
Merged

fix: remove operator's usage of the proxy setting #31003

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/documentation/upgrading/topics/changes/changes-26_0_0.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ Consequently, all caches are cleared when upgrading to this version.

To prevent losing user sessions upgrade to Keycloak 25 first and enable the persistent sessions feature as outlined in the migration guide for {project_name} 25.

= Operator no longer defaults to proxy=passthrough

The Operator will no longer default to the hostname v1 setting of proxy=passthrough. This allows deployments using hostname v2 for a fixed edge hostname to work as desired without additional options.

= New method in `ClusterProvider` API

The following method was added to `org.keycloak.cluster.ClusterProvider`:
Expand Down
3 changes: 1 addition & 2 deletions operator/src/main/java/org/keycloak/operator/Constants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,7 @@ public final class Constants {
public static final List<ValueOrSecret> DEFAULT_DIST_CONFIG_LIST = List.of(
new ValueOrSecret("health-enabled", "true"),
new ValueOrSecret("cache", "ispn"),
new ValueOrSecret("cache-stack", "kubernetes"),
new ValueOrSecret("proxy", "passthrough")
new ValueOrSecret("cache-stack", "kubernetes")
);


Expand Down
7 changes: 0 additions & 7 deletions .../src/main/java/org/keycloak/operator/controllers/KeycloakDeploymentDependentResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,13 +378,6 @@ private void addEnvVars(StatefulSet baseDeployment, Keycloak keycloakCR, TreeSet
// include the kube CA if the user is not controlling KC_TRUSTSTORE_PATHS via the unsupported or the additional
varMap.putIfAbsent(KC_TRUSTSTORE_PATHS, new EnvVarBuilder().withName(KC_TRUSTSTORE_PATHS).withValue(truststores).build());

// TODO remove this once the --proxy option is finally removed from Keycloak
// not strictly necessary as --proxy-headers take precedence over --proxy but at least removes the warning
// about deprecated --proxy option in use
if (varMap.containsKey(getKeycloakOptionEnvVarName("proxy-headers"))) {
varMap.remove(getKeycloakOptionEnvVarName("proxy"));
}

var envVars = new ArrayList<>(varMap.values());
baseDeployment.getSpec().getTemplate().getSpec().getContainers().get(0).setEnv(envVars);

Expand Down
32 changes: 0 additions & 32 deletions operator/src/test/java/org/keycloak/operator/testsuite/integration/KeycloakIngressTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,38 +104,6 @@ public void testIngressOnHTTPSAndProxySettings() {
.anyMatch(e -> "KC_PROXY_HEADERS".equals(e.getName()) && "xforwarded".equals(e.getValue()));
}

// TODO remove this test once the --proxy option is finally removed from Keycloak
@Test
public void testFallbackToDefaultProxySettings() {
var kc = getTestKeycloakDeployment(false);
var hostnameSpecBuilder = new HostnameSpecBuilder()
.withStrict(false)
.withStrictBackchannel(false);
if (isOpenShift) {
kc.getSpec().setIngressSpec(new IngressSpecBuilder().withIngressClassName(KeycloakController.OPENSHIFT_DEFAULT).build());
}
kc.getSpec().setHostnameSpec(hostnameSpecBuilder.build());
kc.getSpec().setProxySpec(null);

K8sUtils.deployKeycloak(k8sclient, kc, true);

String testHostname;
if (isOpenShift) {
testHostname = k8sclient.resource(kc).get().getSpec().getHostnameSpec().getHostname();
} else {
testHostname = kubernetesIp;
}

testIngressURLs("https://" + testHostname + ":443");

// just check we really have proxy set correctly
var envVars = k8sclient.apps().statefulSets().withName(kc.getMetadata().getName()).get().getSpec()
.getTemplate().getSpec().getContainers().get(0).getEnv();
assertThat(envVars)
.anyMatch(e -> "KC_PROXY".equals(e.getName()) && "passthrough".equals(e.getValue()))
.noneMatch(e -> "KC_PROXY_HEADERS".equals(e.getName()));
}

private void testIngressURLs(String baseUrl) {
Awaitility.await()
.ignoreExceptions()
Expand Down