Error with Recovery flow on k9s

[ndkhang2008]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

I am following these steps to reset password via email

1. Get recovery flow

curl --request GET \
  --url 'http://127.0.0.1:4455/kratos/self-service/recovery/browser?refresh=true' \
  --header 'accept: application/json' \
  --header 'content-type: application/json'

2. Send code to email

curl --request POST \
  --url 'http://127.0.0.1:4455/kratos/self-service/recovery?flow={{recoveryFlowId}}' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --header 'cookie: {{recoveryFlowCookie}}' \
  --cookie '{{recoveryFlowCookie}}' \
  --data '{
  "csrf_token": "{{recoveryFlowCsrf}}",
  "method": "code",
  "email": "example@gmail.com"
}'

3. Get setting flow

curl --request POST \
  --url 'http://127.0.0.1:4455/kratos/self-service/recovery?flow={{recoveryFlowId}}' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --header 'cookie: {{recoveryFlowCookie}}' \
  --cookie '{{recoveryFlowCookie}}' \
  --data '{
  "csrf_token": "{{recoveryFlowCsrf}}",
  "method": "code",
  "code": "268155"
}'

4. Change password

curl --request POST \
  --url 'http://127.0.0.1:4455/kratos/self-service/settings?flow={{settingFlowId}}' \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --header 'cookie: {{oryKratosSession}};{{settingFlowCookie}}' \
  --cookie '{{oryKratosSession}};{{settingFlowCookie}}' \
  --data '{
  "csrf_token": "{{settingFlowCsrf}}",
  "method": "password",
  "password": "123SupperPassword2025$"
}'

All steps work well in my local machine (docker compose)
But when I deploy on k9s, step 3 gets the response is

{
  "error": {
    "id": "browser_location_change_required",
    "code": 422,
    "status": "Unprocessable Entity",
    "reason": "In order to complete this flow please redirect the browser to: https://www.ory.sh/kratos/docs/fallback/settings?flow=d596e88c-f173-426a-86b5-79ff07e85e27",
    "message": "browser location change required"
  },
  "redirect_browser_to": "https://www.ory.sh/kratos/docs/fallback/settings?flow=d596e88c-f173-426a-86b5-79ff07e85e27"
}

I am trying to search but can not resolve
This is my config

1. Docker

services:
  kratos-migrate:
    image: oryd/kratos:v1.3.0
    environment:
      - LOG_LEVEL=${LOG_LEVEL}
      - DSN=${DSN}
    volumes:
      - type: bind
        source: ./config/kratos
        target: /etc/config/kratos
    command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes
    restart: on-failure
    networks:
      - intranet

  kratos:
    depends_on:
      - kratos-migrate
    image: oryd/kratos:v1.3.0
    ports:
      - '4433:4433' # public
      - '4434:4434' # admin
    restart: unless-stopped
    environment:
      - LOG_LEVEL=${LOG_LEVEL}
      - DSN=${DSN}
    command: serve -c /etc/config/kratos/kratos.yml --watch-courier
    links:
      - postgresd:postgresd
    volumes:
      - type: bind
        source: ./config/kratos
        target: /etc/config/kratos
    networks:
      - intranet

  keto-migrate:
    image: oryd/keto:v0.14.0
    links:
      - postgresd:postgresd
    volumes:
      - type: bind
        source: ./config/keto
        target: /home/ory
    environment:
      - LOG_LEVEL=${LOG_LEVEL}
      - DSN=${DSN}
    command: ["migrate", "up", "-y"]
    restart: on-failure
    networks:
      - intranet

  keto:
    image: oryd/keto:v0.14.0
    links:
      - postgresd:postgresd
    volumes:
      - type: bind
        source: ./config/keto
        target: /home/ory
    ports:
      - "4466:4466" # read
      - "4467:4467" # write
    depends_on:
      - keto-migrate
    environment:
      - DSN=${DSN}
      - LOG_LEVEL=${LOG_LEVEL}
    restart: on-failure
    networks:
      - intranet

  oathkeeper:
    image: oryd/oathkeeper:v0.40.0
    depends_on:
      - kratos
      - keto
    ports:
      - 4455:4455 #proxy
      - 4456:4456 #api
    command:
      serve proxy -c "/etc/config/oathkeeper/oathkeeper.yml"
    environment:
      - LOG_LEVEL=${LOG_LEVEL}
    restart: on-failure
    networks:
      - intranet
    volumes:
      - ./config/oathkeeper:/etc/config/oathkeeper

  postgresd:
    image: postgres:14
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - intranet

  # mailslurper:
  #   image: oryd/mailslurper:latest-smtps
  #   ports:
  #     - '4436:4436'
  #     - '4437:4437'
  #     - '1025:1025'
  #   networks:
  #     - intranet
  mailhog:
    image: mailhog/mailhog:latest
    ports:
      - 1025:1025
      - 8025:8025
    networks:
      - intranet

networks:
  intranet:

volumes:
  postgres_data:

k9s helm version 0.53.0

kratos:
  service:
    courier:
      enabled: true
  kratos:
    config:
      identity:
        schemas:
          - id: default
            url: file:///etc/config/identity.default.schema.json
      selfservice:
        default_browser_return_url: http://127.0.0.1:4455/
        methods:
          password:
            enabled: true
          profile:
            enabled: true
          totp:
            config:
              issuer: Dashboard
            enabled: true
          code:
            passwordless_enabled: true
            enabled: true
            # mfa_enabled: true
            config:
              lifespan: 15m
        flows:
          login:
            lifespan: 24h   
          registration:
            lifespan: 24h
            # after:
            #   password:
            #     hooks:
            #       - hook: session
          settings:
            lifespan: 24h
            required_aal: aal1
            after:
              password:
                hooks:
                  - hook: revoke_active_sessions # this hook revokes all active sessions when a password is changed
          verification:
            enabled: true
            lifespan: 15m
            use: code
          recovery:
            enabled: true
            lifespan: 15m
            use: code
            after:
              hooks:
                - hook: revoke_active_sessions
      session:
        lifespan: 24h
        whoami:
          # required_aal: aal1
          required_aal: highest_available
        cookie:
          same_site: Strict
      cookies:
        same_site: Strict
      courier:
        smtp:
          from_address: noreply@test.com
          from_name: Test Dashboard
      log:
        # change level: info, leak_sensitive_values: false when production
        level: debug
        format: json
        leak_sensitive_values: true

    automigration:
      enabled: true
    identitySchemas:
      "identity.default.schema.json": |
        {
          "$id": "...",
          "$schema": "http://json-schema.org/draft-07/schema#",
          "title": "Person",
          "type": "object",
          "properties": {
            "traits": {
              "type": "object",
              "properties": {
                "email": {
                  "type": "string",
                  "format": "email",
                  "title": "E-Mail",
                  "minLength": 8,
                  "maxLength": 50, 
                  "ory.sh/kratos": {
                    "credentials": {
                      "password": {
                        "identifier": false
                      },
                      "code": {
                        "identifier": true,
                        "via": "email"
                      }
                    },
                    "verification": {
                      "via": "email"
                    },
                    "recovery": {
                      "via": "email"
                    }
                  }
                },
                "username": {
                  "type": "string",
                  "format": "username",
                  "title": "User name",
                  "pattern": "^[a-zA-Z0-9][a-zA-Z0-9@_.-]{7,49}$",
                  "minLength": 8,
                  "maxLength": 50,
                  "ory.sh/kratos": {
                    "credentials": {
                      "password": {
                        "identifier": true
                      },
                      "totp": {
                        "account_name": true
                      }
                    }
                  }
                }
              },
              "required": ["username"],
              "additionalProperties": false
            }
          }
        }
  secret:
    enabled: false
    nameOverride: "my-secrets"
    
  deployment:
    extraEnv:
      - name: DSN
        valueFrom:
          secretKeyRef:
            name: my-secrets
            key: DSN
      - name: COURIER_SMTP_CONNECTION_URI
        valueFrom:
          secretKeyRef:
            name: my-secrets
            key: smtpConnectionURI
  statefulSet:
    extraEnv:
      - name: DSN
        valueFrom:
          secretKeyRef:
            name: my-secrets
            key: DSN
      - name: COURIER_SMTP_CONNECTION_URI
        valueFrom:
          secretKeyRef:
            name: my-secrets
            key: smtpConnectionURI
  job:
    extraEnv:
      - name: DSN
        valueFrom:
          secretKeyRef:
            name: my-secrets
            key: DSN
  cronjob:
    cleanup:
      extraEnv:
        - name: DSN
          valueFrom:
            secretKeyRef:
              name: my-secrets
              key: DSN

Reproducing the bug

Can not reproduce on Docker compose
Can reproduce on K9s

Relevant log output

Relevant configuration

Version

v1.3.0

On which operating system are you observing this issue?

None

In which environment are you deploying?

Kubernetes with Helm

Additional Context

No response