The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To use Keycloak for browser sign-in through an AWS Application Load Balancer managed by AWS Load Balancer Controller, configure the controller’s Gateway API extension resource ListenerRuleConfiguration with an authenticate-oidc action. This is not a standard field on HTTPRoute. The ALB needs an HTTPS listener, and Keycloak’s OIDC endpoints must be reachable through publicly resolvable DNS.
Check controller and Gateway API compatibility first
AWS Load Balancer Controller maps Gateway API Layer 7 HTTPRoute and GRPCRoute traffic to ALBs; Layer 4 routes use NLBs. The current controller guide identifies v2.14.0 or later for ALB Gateway API route support and says the implementation is built for Gateway API v1.6.0. Its general prerequisites state controller v2.13.0 or later, so the route-specific minimum is the relevant threshold for this setup.
| Component or capability | Requirement in the current AWS guide |
|---|---|
| AWS Load Balancer Controller | v2.14.0 or later for ALB Gateway API L7 routes |
| Gateway API implementation basis | Gateway API v1.6.0 |
| General controller prerequisite | v2.13.0 or later |
These are documentation requirements, not a claim that every newer combination has been tested here. Check the documentation and CRD schemas for the exact controller release you run before applying manifests or upgrading. Align the controller, standard Gateway API CRDs, and AWS custom CRDs; avoid relying on unpinned CRD files from a moving development branch.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not mix Layer 4 and Layer 7 protocols on one Gateway: the controller guide says that combination is unsupported.
#1 Best Overall
Install the required Gateway API and AWS CRDs
The ALB Gateway API setup requires the standard Gateway API resources Gateway, GatewayClass, HTTPRoute, and GRPCRoute, along with the AWS controller CRDs TargetGroupConfiguration, LoadBalancerConfiguration, and ListenerRuleConfiguration. Install versions compatible with the controller release and follow that release’s Gateway API guide for installation details.
Keep AWS controller permissions separate from Keycloak credentials
The controller needs AWS permissions to create and reconcile load-balancing resources. For EKS, the installation guide recommends IAM Roles for Service Accounts (IRSA) as the best practice; it also describes EKS Pod Identity and node-role permissions. The guide cautions against node-role permissions because credentials may be available to other pods.
Those permissions are not the Keycloak client credentials. IRSA uses the cluster’s IAM OIDC provider for workload identity and AWS access. Keycloak OIDC is a separate end-user login flow handled by the ALB. Store the Keycloak client ID and secret in a Kubernetes Secret referenced by the listener rule configuration, not in a public manifest.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minutePrepare the Keycloak client and public endpoint values
Create an OIDC client in the Keycloak realm used for this login flow. Use that realm’s OIDC discovery metadata to obtain the issuer, authorization endpoint, token endpoint, and user-info endpoint. Their exact URL paths depend on the Keycloak deployment and realm, so copy the values from the discovery metadata rather than guessing a conventional path.
The ALB OIDC prerequisites require an HTTPS listener and an identity provider with a publicly resolvable DNS name. Configure the Keycloak client’s valid redirect URI to match the callback URI required by the current AWS ALB OIDC documentation for the deployed ALB. The callback value is not universal; do not substitute a localhost address, an internal-only hostname, or a guessed generic callback.
Configure OIDC through ListenerRuleConfiguration
Use the AWS extension resource ListenerRuleConfiguration and its authenticate action to supply OIDC settings for the ALB listener rule. The controller’s API schema includes the following settings:
issuer: the issuer value for the Keycloak realm.authorizationEndpoint,tokenEndpoint, anduserInfoEndpoint: the corresponding URLs from that realm’s discovery metadata.secret: a reference to the Kubernetes Secret holding the client credentials.- Optional controls for scope, extra authentication request parameters, unauthenticated behavior, cookie name, and session timeout.
Do not express this configuration as a built-in HTTPRoute OIDC property or substitute an Ingress-only annotation example. The exact resource relationship and manifest field layout must match the AWS CRD schema installed for your controller release; consult that release’s Gateway API documentation rather than copying an unverified manifest.
The API schema lists openid as the default scope, authenticate as the default behavior for unauthenticated requests, and AWSELBAuthSessionCookie as the default cookie name. Its default session timeout is 604800 seconds (seven days), and the maximum is also 604800 seconds. Confirm the installed schema and the scopes enabled for your Keycloak client before relying on defaults.
Store the client credentials in a Kubernetes Secret
The controller’s general OIDC guidance describes Secret entries named clientID and clientSecret. Create the Secret in the namespace and in the form expected by the Gateway API CRD version you are using, then reference it from the listener configuration. Do not put either credential in a checked-in or publicly shared manifest.
The controller’s Ingress OIDC guidance warns that users able to create relevant routing resources in the same namespace may have a path to use the referenced secret. That warning is documented for Ingress; verify the precise Gateway API RBAC behavior for your deployed release and restrict both Secret access and routing-resource permissions accordingly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify reconciliation and test the browser login
- Apply the resources. Create the Secret and apply the Gateway, route, and
ListenerRuleConfigurationusing the release-compatible schemas. - Check status conditions. Inspect Gateway and route status for accepted and programmed conditions. The controller reconciliation documentation says Gateway status can report whether resources were accepted and programmed, as well as information such as the provisioned load balancer DNS name and ARN.
- Inspect the ALB listener rule. Confirm that the expected authenticate action is present and runs before forwarding traffic to the application target.
- Run a browser round trip. Visit the application without an authenticated session, confirm that the request is redirected into Keycloak sign-in, complete login, and verify that the browser returns to the application.
- Check session behavior. Confirm that subsequent requests behave as expected with the ALB authentication session and that the configured timeout and cookie settings match your operational requirements.
These are operator validation steps, not a report of a live deployment or end-to-end test. If the Gateway is not programmed, resolve controller and CRD reconciliation issues before debugging the Keycloak redirect. If reconciliation succeeds but login fails, check the public reachability of the configured endpoints, the realm metadata values, the client’s allowed redirect URI, and the listener’s HTTPS configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
