<p>I have the problem that I can log on to my dashboard via OIDC, but then the oidc group information is not mapped correctly and I cannot access the corresponding resources.</p>
<p><strong>Basic setup</strong></p>
<ul>
<li>K8s version: 1.19.0</li>
<li>K8s setup: 1 master + 2 worker nodes</li>
<li>Based on Debian 10 VMs</li>
<li>CNI: Calico</li>
<li><a href="https://github.com/louketo/louketo-proxy" rel="nofollow noreferrer">Louketo Proxy</a> as OIDC proxy</li>
<li>OIDC: Keycloak Server (Keycloak X [Quarkus])</li>
</ul>
<p><strong>Configurations</strong></p>
<p>I have configured the K8s apiserver with these parameters.</p>
<p><em>kube-apiserver.yaml</em></p>
<pre><code>- --oidc-issuer-url=https://test.test.com/auth/realms/Test
- --oidc-client-id=test
- --oidc-username-claim=preferred_username
- --oidc-username-prefix=&quot;oidc:&quot;
- --oidc-groups-claim=groups
- --oidc-groups-prefix=&quot;oidc:&quot;
</code></pre>
<p><em>ClusterRoleBinding</em></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: &quot;test-cluster-admin&quot;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: &quot;Test&quot;
</code></pre>
<p>I used the following louketo parameters</p>
<p><em>Louketo Proxy</em></p>
<pre><code>/usr/bin/louketo-proxy --discovery-url=$OIDC_DISCOVERY_URL --client-id=$OIDC_CLIENT_ID --client-secret=$OIDC_CLIENT_SECRET  -listen=$OIDC_LISTEN_URL --encryption-key=$OIDC_ENCRYPTION_KEY --redirection-url=$OIDC_REDIRECTION_KEY --enable-refresh-tokens=true --upstream-url=$OIDC_UPSTREAM_URL --enable-metrics
</code></pre>
<p>I get the following error message inside the dashboard.
<em>K8s error</em></p>
<pre><code>replicasets.apps is forbidden: User &quot;\&quot;oidc:\&quot;&lt;user_name&gt;&quot; cannot list resource &quot;replicasets&quot; in API group &quot;apps&quot; in the namespace &quot;default&quot;
</code></pre>
<p>I hope you can help me with this problem, I already tried most of the manuals from the internet, but haven't found a solution yet.</p>
<p>PS: I have done the corresponding group mapping in the Keycloak server and also validated that the group entry is transferred.</p>

<p>If you are facing the same challenge as I did and you want to integrate Keycloak into your K8s cluster, share the dashboard and connect it to Keycloak, you can find my configuration below. Within my cluster I use the Louketo Proxy as interface between Kubernetes and Keycloak. The corresponding configuration of the deployment is not included in this post.</p>
<p><strong>Keycloak</strong></p>
<p>I want to start with the configuration of Keycloak. In the first step I created a corresponding client with the following settings.
<a href="https://i.stack.imgur.com/0HVZW.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0HVZW.jpg" alt="Keycloak client configuration" /></a></p>
<p>After that I created the two group membership and audience (needed by the louketo proxy) mappers.
<a href="https://i.stack.imgur.com/AfMjB.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AfMjB.jpg" alt="Keycloak kubernetes mappers" /></a></p>
<p>The exact settings of the mappers can be taken from the two images.</p>
<p><strong>Group membership mapping</strong></p>
<p><a href="https://i.stack.imgur.com/YuJJ6.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YuJJ6.jpg" alt="Group membership mapping" /></a>
<strong>Audience mapping</strong></p>
<p><a href="https://i.stack.imgur.com/EmTw7.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EmTw7.jpg" alt="Audience mapping" /></a></p>
<p><strong>Kubernetes</strong></p>
<p>In the second step I had to update the api server manifest and create the <code>RoleBinding</code> and <code>ClusterRoleBinding</code> within the Kubernetes cluster.</p>
<p><strong>Api server manifest</strong> <em>(<code>default path: /etc/kubernetes/manifests/kube-apiserver.yaml</code>)</em></p>
<pre><code>- --oidc-issuer-url=https://test.test.com/auth/realms/Test
- --oidc-client-id=test
- --oidc-username-claim=preferred_username
- --oidc-username-prefix=&quot;oidc:&quot;
- --oidc-groups-claim=groups
- --oidc-groups-prefix=&quot;oidc:&quot;
</code></pre>
<p><strong>RoleBinding</strong></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: &quot;test&quot;
  namespace: &quot;kubernetes-dashboard&quot;
subjects:
- kind: User
  name: &quot;\&quot;oidc:\&quot;Test&quot;
  namespace: &quot;kube-system&quot;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
</code></pre>
<p><strong>ClusterRoleBinding</strong></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: &quot;test&quot;
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: &quot;\&quot;oidc:\&quot;Test&quot;
</code></pre>
<p><em>@Community I hope I can help you with this configuration. If you have any questions, feel free to ask me.</em></p>
