fix(keycloak): point HTTPRoute backends at the service port by lllamnyp · Pull Request #3235 · cozystack/cozystack

Timofei Larkin (lllamnyp) · 2026-07-07T15:31:59Z

Summary

With gateway-enabled: "true", every Keycloak hostname answers 503 from envoy. The keycloak-http Service exposes a single port, 8080:

ports:
  - name: http
    port: 8080

but all three HTTPRoute backendRefs in packages/system/keycloak/templates/httproute.yaml reference port: 80. Gateway API resolves a backendRef against the Service's declared ports, so no backend resolves and the route serves 503. The Ingress template is unaffected because it references the port by name (http).

Observed live on the freedom dev cluster: all Keycloak hosts returned 503 via the Gateway; hand-patching the route's backend port to 8080 restored service.

Change

Point the three backendRefs (public route, its no-adminHost variant, and the admin route) at port 8080.

Verified with helm template -s templates/httproute.yaml (with and without ingress.adminHost): both routes render with port: 8080.

Summary by CodeRabbit

Bug Fixes
- Updated Keycloak HTTP routing so both the main and admin routes forward traffic to the correct backend service port (from 80 to 8080), improving reliability and access.

gemini-code-assist · 2026-07-07T15:32:07Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request corrects a configuration mismatch in the Keycloak HTTPRoute templates. By updating the backend port references to match the service's defined port, it ensures that traffic is correctly routed through the Gateway API, preventing 503 service unavailable errors.

Highlights

Gateway API Configuration: Updated the HTTPRoute backend references to point to port 8080 instead of 80.
Service Connectivity: Resolved 503 errors encountered when using the Gateway API by aligning the backend port with the actual service port defined in the Keycloak deployment.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-07-07T15:32:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d4713aee-099a-42c2-a7c0-9338ce6f8d2a

📥 Commits

Reviewing files that changed from the base of the PR and between cfd7f63 and 7475491.

📒 Files selected for processing (1)

packages/system/keycloak/templates/httproute.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

packages/system/keycloak/templates/httproute.yaml

📝 Walkthrough

Walkthrough

The Keycloak HTTPRoute template changes the keycloak-http backend port from 80 to 8080 in both the primary and admin routes.

Changes

Keycloak HTTPRoute Port Update

Layer / File(s)	Summary
Update backend port in HTTPRoute rules `packages/system/keycloak/templates/httproute.yaml`	The `keycloak-http` backend port changes from 80 to 8080 in both routes.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: lexfrei, androndo, sircthulhu, ivanhunters, myasnikovdaniil

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: updating Keycloak HTTPRoute backends to use the service port.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/keycloak-httproute-port

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request updates the Keycloak HTTPRoute template (packages/system/keycloak/templates/httproute.yaml) to change the backend service port for keycloak-http from 80 to 8080 in multiple routing rules. No review comments were provided, and the changes appear correct, so there is no additional feedback.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Andrei Kvapil (kvaps)

LGTM. Root cause is clear: keycloak-http exposes port 8080 while the three HTTPRoute backendRefs targeted port 80, so Gateway API resolves no backend and envoy returns 503 for every Keycloak host under gateway-enabled. Pointing the routes at 8080 fixes it; the Ingress path is unaffected since it references the port by name.

The keycloak-http Service only exposes port 8080, but every HTTPRoute backendRef referenced port 80. The Gateway API resolves backendRefs against the Service's declared ports, so the route had no valid backend and envoy answered 503 for all Keycloak hostnames whenever gateway-enabled is true. The Ingress template is unaffected: it references the port by name (http). Signed-off-by: Timofei Larkin <[email protected]>

github-actions · 2026-07-19T20:40:09Z

Created backport PR for release-1.5:

[Backport release-1.5] fix(keycloak): point HTTPRoute backends at the service port #3356 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-3235-to-release-1.5
git worktree add --checkout .worktree/backport-3235-to-release-1.5 backport-3235-to-release-1.5
cd .worktree/backport-3235-to-release-1.5
git reset --hard HEAD^
git cherry-pick -x 747549168668376523e2548dff2709e027ef93df
git push --force-with-lease

Backport of #3235 onto release-1.5. With gateway-enabled: "true" every Keycloak hostname answered 503 from envoy: the keycloak-http Service exposes only port 8080, while the HTTPRoute backendRef referenced port 80, and Gateway API resolves a backendRef against the Service's declared ports, so nothing resolved. The Ingress template was never affected because it references the port by name. release-1.5 has a single HTTPRoute, so the fix here is the one port. main's version of this file carries the admin-hostname split (a separate public/admin route pair added after v1.5.2 and not backported), which is why the bot's cherry-pick collided: it tried to import that whole structure, including two `$adminHost` variables this branch never defines. Assisted-By: Claude <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]> (cherry picked from commit a7e650e6e96addb274ffd5c18e502f00b3f3cb06)

Timofei Larkin (lllamnyp) requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 7, 2026 15:32

dosubot Bot added area/networking Issues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn) kind/backport Categorizes issue or PR as requiring a backport to the current release line kind/bug Categorizes issue or PR as related to a bug labels Jul 7, 2026

gemini-code-assist Bot reviewed Jul 7, 2026

View reviewed changes

Andrei Kvapil (kvaps) approved these changes Jul 7, 2026

View reviewed changes

Andrei Kvapil (kvaps) enabled auto-merge July 7, 2026 15:38

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review size/XS This PR changes 0-9 lines, ignoring generated files labels Jul 7, 2026

Aleksei Sviridkin (lexfrei) force-pushed the fix/keycloak-httproute-port branch from ba83d9c to cfd7f63 Compare July 17, 2026 14:13

github-actions Bot added the area/keycloak Issues or PRs related to Keycloak (SSO / identity) label Jul 17, 2026

Aleksei Sviridkin (lexfrei) force-pushed the fix/keycloak-httproute-port branch from cfd7f63 to 7475491 Compare July 18, 2026 19:51

Andrei Kvapil (kvaps) merged commit 7e206e2 into main Jul 19, 2026
21 of 22 checks passed

Andrei Kvapil (kvaps) deleted the fix/keycloak-httproute-port branch July 19, 2026 20:39

github-actions Bot mentioned this pull request Jul 19, 2026

[Backport release-1.5] fix(keycloak): point HTTPRoute backends at the service port #3356

Open

Navigation Menu

Repository navigation

fix(keycloak): point HTTPRoute backends at the service port - #3235

fix(keycloak): point HTTPRoute backends at the service port#3235
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
fix/keycloak-httproute-port

Timofei Larkin (lllamnyp) commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Andrei Kvapil (kvaps) left a comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Timofei Larkin (lllamnyp) commented Jul 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Andrei Kvapil (kvaps) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Timofei Larkin (lllamnyp) commented Jul 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading