Repository navigation
docs(keycloakx): describe proxy values as KC_PROXY_HEADERS and drop the KC_PROXY example - #939
Merged
dominiquemetz merged 1 commit intoNov 6, 2026
Conversation
The README said proxy.enabled sets KC_PROXY and proxy.http.enabled turns on "HTTP forwarding". The template sets KC_PROXY_HEADERS from proxy.mode and KC_HTTP_ENABLED from proxy.http.enabled. The reverse proxy section still told users to set KC_PROXY=passthrough through extraEnv. Keycloak deprecated that option in 24 and removed it in 26. On 26.6.4 it only logs "Hostname v1 options [proxy] are still in use" and forwarded headers are not used, so the issuer stays on the internal address. Show the proxy.mode values instead. Refs codecentric#830 Signed-off-by: YoungjuKim <[email protected]>
Contributor
|
Thank you for updating the documentation! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README's parameter table says
proxy.enabledsetsKC_PROXYand thatproxy.http.enabledenables "HTTP forwarding". The template does something else (statefulset.yaml):proxy.enabledsetsKC_PROXY_HEADERStoproxy.mode(forwardedorxforwarded);proxy.http.enabledsetsKC_HTTP_ENABLED=true, independent ofproxy.enabled.The "Running Keycloak Behind a Reverse Proxy" section still tells users to put
KC_PROXY=passthroughinextraEnv. Keycloak deprecated theproxyoption in 24 and removed it in 26 (upgrading guide, "Proxy option removed" under 26.0.0). Following that section on a current image therefore does nothing for forwarded headers.This was reported in #830, which was closed by the stale bot without a change.
What I checked
Keycloak 26.6.4 (the image of this chart's previous release),
kc.sh start-dev, one request to/realms/master/.well-known/openid-configurationcarrying bothX-Forwarded-Host/ProtoandForwardedheaders forkc.example.test, https:issuerhttp://127.0.0.1:8080/realms/masterKC_PROXY=passthrough(README example)WARNING: Hostname v1 options [proxy] are still in use, please review your configurationhttp://127.0.0.1:8080/realms/masterKC_PROXY_HEADERS=xforwarded(whatproxy.mode: xforwardedrenders)https://kc.example.test/realms/masterOn a running 7.2.3 release with
proxy.enabled: falseand defaultproxy.http.enabled, the StatefulSet hasKC_HTTP_ENABLED=trueand noKC_PROXY_HEADERS, which matches the template reading above.Change
proxy.enabled,proxy.mode,proxy.http.enabled.KC_PROXYexample with theproxyvalues, say thatKC_PROXYno longer works on Keycloak 26, add the usual warning that these headers must only be trusted behind a proxy that overwrites them, and link the Keycloak reverse proxy guide.README only, so I did not bump the chart version (like #859 and #932). Happy to bump it if you want this released.
Refs #830
This change was drafted with AI assistance and reviewed by me.
🤖 Generated with Claude Code