Adjusting ports and better support for mac/podman

Signed-off-by: Matthias Wessendorf <[email protected]>

Author: matzew

build/keycloak.mk

@@ -35,13 +35,21 @@ kind-create-cluster: kind kind-create-certs ## Create the kind cluster for devel
 		echo "Installing cert-manager..."; \
 		kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml; \
 		echo "Waiting for cert-manager to be ready..."; \
-		kubectl wait --namespace cert-manager --for=condition=ready pod --selector=app.kubernetes.io/instance=cert-manager --timeout=120s; \
-		kubectl wait --namespace cert-manager --for=condition=ready pod --selector=app.kubernetes.io/name=webhook --timeout=120s; \
+		kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager --timeout=120s; \
+		kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-cainjector --timeout=120s; \
+		kubectl wait --namespace cert-manager --for=condition=available deployment/cert-manager-webhook --timeout=120s; \
 		echo "✅ cert-manager ready"; \
 		echo "Creating cert-manager ClusterIssuer..."; \
 		sleep 5; \
 		kubectl apply -f config/cert-manager/selfsigned-issuer.yaml; \
 		echo "✅ ClusterIssuer created"; \
+		echo "Adding /etc/hosts entry for Keycloak in control plane..."; \
+		if command -v docker >/dev/null 2>&1 && docker ps --filter "name=$(KIND_CLUSTER_NAME)-control-plane" --format "{{.Names}}" | grep -q "$(KIND_CLUSTER_NAME)-control-plane"; then \
+			docker exec $(KIND_CLUSTER_NAME)-control-plane bash -c 'grep -q "keycloak.127-0-0-1.sslip.io" /etc/hosts || echo "127.0.0.1 keycloak.127-0-0-1.sslip.io" >> /etc/hosts'; \
+		elif command -v podman >/dev/null 2>&1 && podman ps --filter "name=$(KIND_CLUSTER_NAME)-control-plane" --format "{{.Names}}" | grep -q "$(KIND_CLUSTER_NAME)-control-plane"; then \
+			podman exec $(KIND_CLUSTER_NAME)-control-plane bash -c 'grep -q "keycloak.127-0-0-1.sslip.io" /etc/hosts || echo "127.0.0.1 keycloak.127-0-0-1.sslip.io" >> /etc/hosts'; \
+		fi; \
+		echo "✅ /etc/hosts entry added"; \
 	fi
 
 .PHONY: kind-delete-cluster

build/kind.mk

@@ -350,6 +350,10 @@ spec:
               containerPort: 443
               protocol: TCP
               hostPort: 443
+            - name: https-alt
+              containerPort: 443
+              protocol: TCP
+              hostPort: 8443
             - name: webhook
               containerPort: 8443
               protocol: TCP

config/ingress/nginx-ingress.yaml

@@ -26,12 +26,12 @@ spec:
         image: quay.io/keycloak/keycloak:26.4
         args: ["start-dev"]
         env:
-        - name: KEYCLOAK_ADMIN
+        - name: KC_BOOTSTRAP_ADMIN_USERNAME
           value: "admin"
-        - name: KEYCLOAK_ADMIN_PASSWORD
+        - name: KC_BOOTSTRAP_ADMIN_PASSWORD
           value: "admin"
-        - name: KC_HOSTNAME_STRICT
-          value: "false"
+        - name: KC_HOSTNAME
+          value: "https://keycloak.127-0-0-1.sslip.io:8443"
         - name: KC_HTTP_ENABLED
           value: "true"
         - name: KC_HEALTH_ENABLED

config/keycloak/deployment.yaml

@@ -10,6 +10,11 @@ metadata:
     cert-manager.io/cluster-issuer: "selfsigned-ca-issuer"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    # Required for Keycloak 26.2.0+ to include port in issuer URLs
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Forwarded-Port 8443;
+      proxy_set_header X-Forwarded-Host $host:8443;
 spec:
   ingressClassName: nginx
   tls:

config/keycloak/ingress.yaml

@@ -1,7 +1,7 @@
 # RBAC ClusterRoleBinding for mcp user with OIDC authentication
 #
 # IMPORTANT: This requires Kubernetes API server to be configured with OIDC:
-#   --oidc-issuer-url=https://keycloak.127-0-0-1.sslip.io/realms/openshift
+#   --oidc-issuer-url=https://keycloak.127-0-0-1.sslip.io:8443/realms/openshift
 #   --oidc-username-claim=preferred_username
 #
 # Without OIDC configuration, this binding will not work.
@@ -17,4 +17,4 @@ roleRef:
 subjects:
 - apiGroup: rbac.authorization.k8s.io
   kind: User
-  name: https://keycloak.127-0-0-1.sslip.io/realms/openshift#mcp
+  name: https://keycloak.127-0-0-1.sslip.io:8443/realms/openshift#mcp

config/keycloak/rbac.yaml

@@ -16,15 +16,15 @@ nodes:
     kind: ClusterConfiguration
     apiServer:
       extraArgs:
-        oidc-issuer-url: https://keycloak.127-0-0-1.sslip.io/realms/openshift
+        oidc-issuer-url: https://keycloak.127-0-0-1.sslip.io:8443/realms/openshift
         oidc-client-id: openshift
         oidc-username-claim: preferred_username
         oidc-groups-claim: groups
         oidc-ca-file: /etc/kubernetes/pki/keycloak-ca.crt
   extraPortMappings:
   - containerPort: 80
-    hostPort: 80
+    hostPort: 8080
     protocol: TCP
   - containerPort: 443
-    hostPort: 443
+    hostPort: 8443
     protocol: TCP