Repository navigation
Documents the operator's support for TLS re-encryption. - #47565
Conversation
There was a problem hiding this comment.
Thank you for the pr @gilvansfilho
I think it reads much better than before. Just a couple of thoughts.
closes keycloak#20128 Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com> Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>
|
@gilvansfilho are you ready to take this out of draft? |
|
@shawkins very busy days here... |
There was a problem hiding this comment.
Thank you @gilvansfilho this looks good to me.
I'll add in a couple more reviewers.
There was a problem hiding this comment.
Thank you for the PR. I think it is an improvement, and I'm +1 to merge it.
I think that "double check your reverse proxy" needs some more work as it is not very specific. As we know, a mismatch can lead to bad results where a client can send HTTP headers that are then wrongly accepted by Keycloak.
At the same time, this statement has been here before, and I won't stall it just for that.
| hostname: | ||
| hostname: keycloak.<cluster-domain> <1> | ||
| proxy: | ||
| headers: xforwarded # double check your reverse proxy sets and overwrites the X-Forwarded-* headers |
There was a problem hiding this comment.
I consider "double check your reverse proxy" a bit too vague for a documentation.
What should people do here?
There was a problem hiding this comment.
Happy to handle this in a follow-up issue.
There was a problem hiding this comment.
I consider "double check your reverse proxy" a bit too vague for a documentation.
What should people do here?
Perhaps the text bellow is better:
Check your load balancer or reverse proxy configuration to determine whether it utilizes the Forwarded (RFC 7239) or X-Forwarded-* (e.g., X-Forwarded-For) mechanism for header propagation, so set this option accordingly
There was a problem hiding this comment.
But a bit large for a comment in a code block
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>
There was a problem hiding this comment.
Thank you, moved it to a callout. Should be fine to merge now.
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
|
Thank you @gilvansfilho |
* documents the operator's support for TLS re-encryption. closes keycloak#20128 Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com> * Update docs/guides/operator/basic-deployment.adoc Co-authored-by: Steven Hawkins <shawkins@redhat.com> Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com> * Apply suggestions from code review Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com> * Moving updated text to a callout Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com> --------- Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com> Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com> Co-authored-by: Steven Hawkins <shawkins@redhat.com> Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net> Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
closes #20128