Jenkins on K8s OIDC redirect behind Nginx Reverse Proxy

Question

我正在设置一个 Nginx 反向代理，用于通过端口 30000 将域中的所有流量重定向到 kubernetes 集群。Kubernetes 正在收集任何工作负载并将其发送到基于子域的相关服务（使用 Istio / 虚拟服务） .

虽然这很有效，但我注意到一些奇怪的效果作为 Open ID Connect (Keycloak) 重定向的一部分。重定向 URLs 不是使用浏览器 URLs，而是 Kubernetes 内部 DNS 名称和端口。

我想请求你的帮助，checking/correcting我的 Nginx 配置。我当前的示例问题是 Jenkins 连接到 Keycloak，但重定向 URL 不正确：

https://keycloak.example.de/auth/realms/myrealm/protocol/openid-connect/auth?client_id=jenkins-client&redirect_uri=https://**jenkins-svc.jenkins.svc.cluster.local**/securityRealm/finishLogin&response_type=code&scope=web-origins%20address%20phone%20openid%20offline_access%20profile%20roles%20microprofile-jwt%20email&state=OGIxYWEzZGYtMmY1NS00

Redirect_URI 应为 jenkins.example.de 但已设置为 jenkins-svc.jenkins.svc.cluster.local（不正确）。出于任何原因使用 Kubernetes 内部服务名称。

Nginx 配置

# Redirect Subdomains (incl. Web-Socket)
server {
    listen 8443 ssl;
    
    ssl_certificate      /certs/server.crt;
    ssl_certificate_key  /certs/server.key;
    
    server_name ~^(.*).example.de;
    access_log /opt/bitnami/nginx/logs/yourapp_access.log;
    error_log /opt/bitnami/nginx/logs/yourapp_error.log;
    
    # Security Limits (Connection slow-down)
    client_body_timeout 3s;
    client_header_timeout 3s;
    
    location / {
    
        # Security Limits
        limit_req zone=limit burst=100 nodelay; # or delay=15;
        limit_conn addr 100;
    
        proxy_set_header     X-Real-IP $remote_addr;
        proxy_set_header     HOST $http_host;
        proxy_set_header     X-NginX-Proxy true;
 
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade; 
        proxy_set_header Connection $connection_upgrade;
        
        # Keycloak
        proxy_set_header X-Forwarded-Host  $host;
 
        proxy_set_header Referer $http_referer;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port 443; # Hard-Coded as K8s Port was within variable.. :-(
 
        set $upstream redirect.example.de;
        proxy_pass https://$upstream:30000;
        proxy_redirect off;
    }
}

Answer 1

看起来重定向是由 Jenkins 错误引起的 Configure System/ Jenkins URL:

enter image description here

Jenkins on K8s OIDC redirect behind Nginx Reverse Proxy

Jenkins on K8s OIDC redirect behind Nginx Reverse Proxy

nginx

jenkins

kubernetes

nginx-reverse-proxy