Fix Keycloak provider redirect_uri to use HTTPS behind reverse proxy (apache#61095)

* docs: Enhance Airflow API server configuration in values.yaml

* docs: Update Airflow API server args description to include reverse proxy support and provide usage example

* docs: Update API server env vars description to include reverse proxy configuration and provide example usage

* docs: Add Helm chart configuration details for running Airflow behind a reverse proxy

Author: arjav1528

airflow-core/docs/howto/run-behind-proxy.rst

@@ -66,6 +66,50 @@ To do so, you need to set the following setting in your ``airflow.cfg``::
 - Please make sure your proxy does not enforce http-only status on the Set-Cookie headers.
   Airflow frontend needs to access the cookies through javascript, and a http-only flag would disturb this functionality.
 
+Helm Chart Configuration
+------------------------
+
+When deploying Airflow using the Helm chart behind a reverse proxy (e.g., nginx ingress), you need to configure the API server to respect proxy headers.
+
+Configure the API server arguments to include the ``--proxy-headers`` flag::
+
+    apiServer:
+      args: ["bash", "-c", "exec airflow api-server --proxy-headers"]
+
+If your proxy server is not on the same host as Airflow, set the ``FORWARDED_ALLOW_IPS`` environment variable::
+
+    apiServer:
+      args: ["bash", "-c", "exec airflow api-server --proxy-headers"]
+      env:
+        - name: FORWARDED_ALLOW_IPS
+          value: "*"  # Use "*" for trusted environments, or specify proxy IP ranges for production
+
+Additionally, configure your ingress annotations to pass the necessary headers. For nginx ingress, add these annotations::
+
+    ingress:
+      apiServer:
+        enabled: true
+        annotations:
+          nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
+          nginx.ingress.kubernetes.io/proxy-redirect-off: "true"
+          nginx.ingress.kubernetes.io/configuration-snippet: |
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+        hosts:
+          - name: airflow.example.com
+            tls:
+              enabled: true
+              secretName: airflow-tls
+
+Make sure to also set the ``base_url`` in your Airflow configuration::
+
+    config:
+      api:
+        base_url: https://airflow.example.com
+
 .. spelling::
 
   Uvicorn

chart/values.schema.json

@@ -5821,7 +5821,7 @@
                     "default": null
                 },
                 "args": {
-                    "description": "Args to use when running the Airflow API server (templated).",
+                    "description": "Args to use when running the Airflow API server (templated). When running behind a reverse proxy, add `--proxy-headers` to enable Uvicorn to respect X-Forwarded-Proto, X-Forwarded-For, and X-Forwarded-Port headers.",
                     "type": [
                         "array",
                         "null"
@@ -5833,6 +5833,13 @@
                         "bash",
                         "-c",
                         "exec airflow api-server"
+                    ],
+                    "examples": [
+                        [
+                            "bash",
+                            "-c",
+                            "exec airflow api-server --proxy-headers"
+                        ]
                     ]
                 },
                 "strategy": {
@@ -6351,9 +6358,17 @@
                     }
                 },
                 "env": {
-                    "description": "Add additional env vars to API server.",
+                    "description": "Add additional env vars to API server. When running behind a reverse proxy, set `FORWARDED_ALLOW_IPS` to specify which IPs are trusted to send X-Forwarded-* headers. Use `\"*\"` for trusted environments, or specify proxy IP ranges for production.",
                     "type": "array",
                     "default": [],
+                    "examples": [
+                        [
+                            {
+                                "name": "FORWARDED_ALLOW_IPS",
+                                "value": "*"
+                            }
+                        ]
+                    ],
                     "items": {
                         "type": "object",
                         "properties": {

chart/values.yaml

@@ -1617,8 +1617,15 @@ apiServer:
   # Command to use when running the Airflow API server (templated).
   command: ~
   # Args to use when running the Airflow API server (templated).
+  # Example: To enable proxy headers support when running behind a reverse proxy:
+  # args: ["bash", "-c", "exec airflow api-server --proxy-headers"]
   args: ["bash", "-c", "exec airflow api-server"]
   allowPodLogReading: true
+  # Environment variables for the Airflow API server.
+  # Example: To configure FORWARDED_ALLOW_IPS when running behind a reverse proxy:
+  # env:
+  #   - name: FORWARDED_ALLOW_IPS
+  #     value: "*"  # Use "*" for trusted environments, or specify proxy IP ranges for production
   env: []
 
   # Allow Horizontal Pod Autoscaler (HPA) configuration for apiServer. (optional)