Cannot access Keycloak account-console in Kubernetes (403)

Question

I have found a strange behavior in Keycloak when deployed in Kubernetes, that I can't wrap my head around.

Use-case:

• login as admin:admin (created by default)
• click on Manage account

(manage account dialog screenshot)

I have compared how the (same) image (quay.io/keycloak/keycloak:17.0.0) behaves if it runs on Docker or in Kubernetes (K3S).

If I run it from Docker, the account console loads. In other terms, I get a success (204) for the request

GET /realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=account-console

From the same image deployed in Kubernetes, the same request fails with error 403. However, on this same application, I get a success (204) for the request

GET /realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=security-admin-console

Since I can call security-admin-console, this does not look like an issue with the Kubernetes Ingress gateway nor with anything related to routing.

I've then thought about a Keycloak access-control configuration issue, but in both cases I use the default image without any change. I cross-checked to be sure, it appears that the admin user and the account-console client are configured exactly in the same way in both the docker and k8s applications.

I have no more idea about what could be the problem, do you have any suggestion?

Answer 1

I had the same issue, and solved it by adding the correct origin to the account-console client in the keycloak UI. Clients -> account-console -> Web origins