[bitnami/keycloak] keycloak behind traefik works but doesn't log the client ip

[mhazan01]

Name and Version

bitnami/keycloak latest

What architecture are you using?

amd64

What steps will reproduce the bug?

helm install keycloak oci://registry-1.docker.io/bitnamicharts/keycloak --create-namespace -n keycloak -f values.yaml
values.yaml contain configuration for ingress with traefik

Are you using any custom parameters or values?

ingress:
  ingressClassName: "traefik"
extraEnvVars:
  - name: PROXY_ADDRESS_FORWARDING
    value: "true" 

What is the expected behavior?

keycloak logs show real client ip

What do you see instead?

keycloak logs show loadbalancer ip

Additional information

i've been able to get the real client ip on the whoami container, using forwardedHeaders: and proxyProtocol: but i'am unable to reproduce the configuration in the keycloak chart, i assumed PROXY_ADDRESS_FORWARDING was it. anyone able to help me figure out where and which parameters to add in the chart ?

[javsalgar]

Hi, the issue may not be directly related to the Bitnami container image/Helm chart, but rather to how the application is being utilized, configured in your specific environment, or tied to a particular scenario that is not easy to reproduce on our side.

If you think that's not the case and want to contribute a solution, we'd like to invite you to create a pull request. The Bitnami team is excited to review your submission and offer feedback. You can find the contributing guidelines here.

Your contribution will greatly benefit the community. Please feel free to contact us if you have any questions or need assistance.

Suppose you have any questions about the application, customizing its content, or technology and infrastructure usage. In that case, we highly recommend that you refer to the forums and user guides provided by the project responsible for the application or technology.

With that said, we'll keep this ticket open until the stale bot automatically closes it, in case someone from the community contributes valuable insights.

[mhazan01]

Hey, thanks, yes indeed, it's probably linked to my specific implementation, was trying to follow the documentation here : https://www.keycloak.org/server/reverseproxy sugesting to add bin/kc.[sh|bat] start --proxy-protocol-enabled true, but i'm unsure how to translate this script command into the chart ?

[mhazan01]

i managed to get it working using the proper combination in chart:
production: true
proxyHeaders: "xforwarded"
proxy: "edge"
sadly i get error when trying to pass extraStartupArgs: such as --proxy-trusted-addresses (doesn't recognise 192.168.0.0/16 as a cidr notation)