<p>I have tried to set up Kubernetes 1.13 for OpenID Connect (OIDC) authentication as follows:</p>

<ul>
<li>installed Keycloak server</li>
<li>added command line options <code>--oidc-issuer-url=https://my_keycloak/auth/realms/my_realm</code>, etc., to <code>kube-apiserver</code></li>
<li>stored id token at <code>users.user.auth-provider.config.client-id</code>, etc., in kubeconfig's <code>my_user</code></li>
</ul>

<p>From my reading of the documentation <code>kubectl</code> should now be able to access the cluster as <code>my_user</code>. However, <code>kubectl get nodes</code> says:</p>

<pre><code>error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>And <code>curl -k https://api_server:6443/api/v2/nodes --header "Authorization: Bearer $id_token"</code> says:</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "Unauthorized",
  "reason": "Unauthorized",
  "code": 401
}
</code></pre>

<p><code>kubectl logs $kube_apiserver -n kube-system</code>, <code>journalctl -u kubelet.service</code>, and Keycloak's stdout are all silent. So where can I see more logging information to discern where OIDC authentication may go wrong?</p>

<p><strong>UPDATE</strong> Option <a href="https://github.com/kubernetes/kubernetes/issues/22723" rel="nofollow noreferrer"><code>--v</code></a> on both the client (<code>keyctl</code>) or the server (e.g. API server) help to some degree.</p>

<p>If you are using the <code>email</code> claim, Kubernetes requires your <code>email_verified</code> claim to be <code>true</code>. By default in Keycloak, this is set to <code>false</code>.</p>
<p>Source: <a href="https://github.com/kubernetes/kubernetes/search?q=email_verified&amp;unscoped_q=email_verified" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/search?q=email_verified&amp;unscoped_q=email_verified</a></p>
