We want to make Keycloak available from the open internet but restrict access to the Admin Console.

We’re considering separating the URLs as follows:

The main Keycloak endpoint will be resolved through a public Ingress, Load Balancer, WAF, etc.

The admin endpoint will be accessible only from the organization’s internal network.