fix(auth/keycloak): use external Keycloak URL for browser-facing OIDC endpoints by dcmcand · Pull Request #111 · nebari-dev/nebari-operator

dcmcand · 2026-04-27T16:31:25Z

Summary

Split SecurityPolicy OIDC endpoint overrides by audience: Token stays on the in-cluster URL (Envoy back-channel), Authorization and EndSession move to the public URL (browser front-channel).
Adds an externalRealmURL() helper mirroring internalRealmURL().
When KEYCLOAK_EXTERNAL_URL is unset, leaves Authorization/EndSession unset; Envoy Gateway then triggers OIDC discovery against the in-cluster issuer. Discovery only produces public URLs if Keycloak's own frontendUrl is configured. Operator now logs a startup warning so this trap is visible.
Updated TestKeycloakProvider_GetEndpointOverrides with five cases covering the split, trailing-slash normalization, and the no-ExternalURL fallback.

Why

On a clean NIC deploy, browsers hitting any NebariApp protected by Keycloak OAuth2 are redirected to http://keycloak-keycloakx-http.keycloak.svc.cluster.local:8080 - which the browser cannot resolve. The OAuth2 flow dead-ends and no UI is reachable.

Surfaced during fresh-install validation of the Nebari LLM Serving Pack (nebari-dev/nebari-llm-serving-pack#65), which loads the key-manager UI as a NebariApp.

Closes #110

Follow-ups (deliberately out of scope here)

OIDC SecurityPolicy.Issuer field stays on in-cluster URL; investigate iss-claim mismatch with Keycloak frontendUrl deployments #112 - Should SecurityPolicy.spec.oidc.provider.Issuer also track KEYCLOAK_EXTERNAL_URL to match the iss claim in tokens issued by Keycloak with frontendUrl configured?
Add reconciler test asserting SecurityPolicy.spec.oidc.provider has Token on in-cluster URL and Authorization on public URL #113 - Add a reconciler-level test asserting Token on in-cluster URL and Authorization+EndSession on public URL end-to-end through buildSecurityPolicySpec.

Test plan

go test ./internal/controller/reconcilers/auth/providers/... passes - five cases covering the split, trailing-slash normalization, no-ExternalURL fallback
go test ./... no regressions vs main (pre-existing TestControllers HTTPRoute scheme failure unrelated)
go build ./... clean
Validation against the llmd-validate cluster: build the operator image, swap it in via a temporary override on NIC's nebari-operator Application, confirm the rendered SecurityPolicy now uses https://keycloak.<base> for Authorization+EndSession, confirm browser login completes

… endpoints The SecurityPolicy generated for a NebariApp with Keycloak auth had all four oidc.provider endpoints populated from the in-cluster Keycloak service URL. The Authorization and EndSession endpoints are browser-facing - the user's browser is redirected to them - so the in-cluster URL fails DNS resolution for the browser and the entire OAuth2 flow dead-ends. Split the override generation by who actually hits each endpoint: - Token: Envoy proxy back-channel (server-side). Keep on the in-cluster URL: lower latency, avoids requiring Envoy to trust the public TLS chain. - Authorization, EndSession: browser front-channel. Use the publicly routable URL from KEYCLOAK_EXTERNAL_URL. When KEYCLOAK_EXTERNAL_URL is unset, leave Authorization and EndSession as nil overrides; Envoy then falls back to the values from the OIDC discovery document fetched at the issuer URL, which works as long as Keycloak's frontendUrl is set correctly. Adds a new externalRealmURL() helper that mirrors internalRealmURL() and trims the optional trailing slash on KEYCLOAK_EXTERNAL_URL. Updated TestKeycloakProvider_GetEndpointOverrides to cover: - the new split (Token internal, Authorization+EndSession external) - the trailing-slash normalization - the fallback when ExternalURL is empty Surfaced during fresh-install validation of the Nebari LLM Serving Pack on a clean NIC AWS deploy: browsers hitting the key-manager UI were 302'd to http://keycloak-keycloakx-http.keycloak.svc.cluster.local:8080 which they cannot resolve. Closes #110

Code review pointed out the previous comment was misleading: 'Envoy falls back to OIDC discovery' is mechanically accurate but the discovery doc returned by an in-cluster Keycloak only contains public URLs if Keycloak itself has frontendUrl configured. Otherwise the discovery doc round-trips the same in-cluster URLs the override would have used, and the browser-facing redirect still dead-ends. Two changes: 1. Tighten the GetEndpointOverrides doc comment to spell out the fallback semantics: it only works when Keycloak's frontendUrl / KC_HOSTNAME_URL is set, otherwise discovery will return in-cluster URLs. 2. Log a one-line WARNING at operator startup when ExternalURL is empty, telling the operator to either set KEYCLOAK_EXTERNAL_URL or configure Keycloak frontendUrl. Visible in operator-manager logs immediately on startup; no action at reconcile time so it doesn't spam per-NebariApp.

github-actions · 2026-04-27T17:07:17Z

Docker Images Built

Images pushed to Quay.io for branch fix-oauth-browser-facing-endpoints-public:

Image	Tag	Platforms
Operator	`quay.io/nebari/nebari-operator:fix-oauth-browser-facing-endpoints-public`	linux/amd64 + linux/arm64

Test the operator:

kubectl apply -k https://github.com/nebari-dev/nebari-operator.git/config/default?ref=fix/oauth-browser-facing-endpoints-public
kubectl set image deployment/nebari-operator-controller-manager manager=quay.io/nebari/nebari-operator:fix-oauth-browser-facing-endpoints-public -n nebari-operator-system

marcelovilla

Thanks for the PR @dcmcand. Just a small comment but approving nonetheless

marcelovilla · 2026-04-28T09:07:06Z

+// externalRealmURL returns the publicly routable base URL for the Keycloak realm,
+// or empty string when KEYCLOAK_EXTERNAL_URL is not configured.
+func (p *KeycloakProvider) externalRealmURL() string {
+	if p.Config.ExternalURL == "" {
+		return ""
+	}
+	return fmt.Sprintf("%s/realms/%s",
+		strings.TrimRight(p.Config.ExternalURL, "/"),
+		p.Config.Realm)
+}
+


Not a blocker but this seems to be the same URL being built by the GetExternalIssuerURL function:

nebari-operator/internal/controller/reconcilers/auth/providers/keycloak.go

Lines 118 to 124 in 0d0a85b

// GetExternalIssuerURL returns the publicly routable Keycloak issuer URL.

func (p *KeycloakProvider) GetExternalIssuerURL(ctx context.Context, nebariApp *appsv1.NebariApp) (string, error) {

if p.Config.ExternalURL == "" {

return "", fmt.Errorf("KEYCLOAK_EXTERNAL_URL not configured; required for external issuer URL")

}

return fmt.Sprintf("%s/realms/%s", strings.TrimRight(p.Config.ExternalURL, "/"), p.Config.Realm), nil

}

Not sure if it's intended because of the difference in handling the p.Config.ExternalURL == "" case but just flagging it in case it's not.

Removes duplicated URL construction flagged in PR #111 review.

github-actions · 2026-04-28T09:41:04Z

Docker Images Built

Images pushed to Quay.io for branch fix-oauth-browser-facing-endpoints-public:

Image	Tag	Platforms
Operator	`quay.io/nebari/nebari-operator:fix-oauth-browser-facing-endpoints-public`	linux/amd64 + linux/arm64

Test the operator:

kubectl apply -k https://github.com/nebari-dev/nebari-operator.git/config/default?ref=fix/oauth-browser-facing-endpoints-public
kubectl set image deployment/nebari-operator-controller-manager manager=quay.io/nebari/nebari-operator:fix-oauth-browser-facing-endpoints-public -n nebari-operator-system

dcmcand added 2 commits April 27, 2026 18:29

marcelovilla approved these changes Apr 28, 2026

View reviewed changes

refactor(auth/keycloak): reuse externalRealmURL in GetExternalIssuerURL

791a503

Removes duplicated URL construction flagged in PR #111 review.

dcmcand merged commit 9fa505a into main Apr 28, 2026
8 checks passed

dcmcand deleted the fix/oauth-browser-facing-endpoints-public branch April 28, 2026 09:40

marcelovilla mentioned this pull request Apr 29, 2026

Bump Nebari Operator version to v0.1.0-alpha.19 nebari-dev/nebari-infrastructure-core#272

Merged

tylerpotts mentioned this pull request Jun 12, 2026

docs(auth): SecurityPolicy issuer stays in-cluster — investigation result for #112, with tests #144

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(auth/keycloak): use external Keycloak URL for browser-facing OIDC endpoints#111

fix(auth/keycloak): use external Keycloak URL for browser-facing OIDC endpoints#111
dcmcand merged 3 commits into
mainfrom
fix/oauth-browser-facing-endpoints-public

dcmcand commented Apr 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

marcelovilla left a comment

Uh oh!

marcelovilla Apr 28, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	// GetExternalIssuerURL returns the publicly routable Keycloak issuer URL.
	func (p KeycloakProvider) GetExternalIssuerURL(ctx context.Context, nebariApp appsv1.NebariApp) (string, error) {
	if p.Config.ExternalURL == "" {
	return "", fmt.Errorf("KEYCLOAK_EXTERNAL_URL not configured; required for external issuer URL")
	}
	return fmt.Sprintf("%s/realms/%s", strings.TrimRight(p.Config.ExternalURL, "/"), p.Config.Realm), nil
	}

Conversation

dcmcand commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Follow-ups (deliberately out of scope here)

Test plan

Uh oh!

github-actions Bot commented Apr 27, 2026

Docker Images Built

Uh oh!

marcelovilla left a comment

Choose a reason for hiding this comment

Uh oh!

marcelovilla Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 28, 2026

Docker Images Built

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dcmcand commented Apr 27, 2026 •

edited

Loading