apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak-public
  labels:
    app.kubernetes.io/name: keycloak
    app.kubernetes.io/instance: keycloak
    app.kubernetes.io/version: "26.6.1"
    app.kubernetes.io/component: identity-provider
    app.kubernetes.io/part-of: auth-platform
    app.kubernetes.io/managed-by: kustomize
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: mnt-keycloak-security-headers@kubernetescrd # frameDeny 제외 — admin 콘솔의 silent SSO iframe 허용
spec:
  ingressClassName: traefik
  rules:
    - host: keycloak.local.test
      http:
        paths:
          - path: /realms/
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  name: http
          - path: /resources/
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  name: http
          - path: /.well-known/
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  name: http
          - path: /js/
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  name: http