<p>I set up a sample Kubernetes Cluster with 3 master nodes and 2 worker nodes.
I tried to connect it to an OpenId Provider (in my case Keycloak). But when querying the API I get the following message from kubectl:</p>
<pre><code>error: You must be logged in to the server (Unauthorized)
</code></pre>
<p>or via curl:</p>
<pre><code>curl -H &quot;Authorization: Bearer $token&quot; -k https://192.168.178.30:6443/api/v1/namespaces/default/pods
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {
    
  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;Unauthorized&quot;,
  &quot;reason&quot;: &quot;Unauthorized&quot;,
  &quot;code&quot;: 401
}
</code></pre>
<p>and in the API server logs it says</p>
<pre><code>Unable to authenticate the request due to an error: invalid bearer token
</code></pre>
<p>According to <a href="https://jwt.io/" rel="nofollow noreferrer">jwt.io</a> my token seems to be valid.</p>
<h2>Configuration of the API server</h2>
<p>In the API server I specified the following parameters:</p>
<pre><code>oidc-issuer-url: https://192.168.178.25:8443/auth/realms/master
oidc-client-id: account
oidc-ca-file: /etc/kubernetes/ssl/keycloak-rootCA.pem
oidc-username-claim: sub
oidc-groups-claim: groups
</code></pre>
<p><em>I had to specify the CA file, because the certificate used for keycloak was a self signed one</em></p>
<p>The certificate seems to work, because a curl without the CA file results in an error; where specifying the CA file doesn't:</p>
<pre><code>ansible@node1:~$ curl https://192.168.178.25:8443/auth/realms/master
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.


ansible@node1:~$ curl --cacert /etc/kubernetes/ssl/keycloak-rootCA.pem https://192.168.178.25:8443/auth/realms/master
{&quot;realm&quot;:&quot;master&quot;,&quot;public_key&quot;:&quot;...&quot;,&quot;token-service&quot;:&quot;https://192.168.178.25:8443/auth/realms/master/protocol/openid-connect&quot;,&quot;account-service&quot;:&quot;https://192.168.178.25:8443/auth/realms/master/account&quot;,&quot;tokens-not-before&quot;:0}
</code></pre>
<h3>JWT Token</h3>
<p>The payload of my JWT token looks the following:</p>
<pre><code>{
  &quot;jti&quot;: &quot;455feab7-5828-49f3-9243-a2ce0a1ae6f9&quot;,
  &quot;exp&quot;: 1557246081,
  &quot;nbf&quot;: 0,
  &quot;iat&quot;: 1557246021,
  &quot;iss&quot;: &quot;https://192.168.178.25:8443/auth/realms/master&quot;,
  &quot;aud&quot;: &quot;account&quot;,
  &quot;sub&quot;: &quot;78f9bdc8-d1a4-43c4-ab83-f1b4645519f6&quot;,
  &quot;typ&quot;: &quot;ID&quot;,
  &quot;azp&quot;: &quot;account&quot;,
  &quot;auth_time&quot;: 1557246020,
  &quot;session_state&quot;: &quot;ccafaa62-a888-43dd-9135-1c5a31766e0b&quot;,
  &quot;acr&quot;: &quot;1&quot;,
  &quot;email_verified&quot;: true,
  &quot;name&quot;: &quot;Testuser&quot;,
  &quot;groups&quot;: [
    &quot;group1&quot;,
    &quot;k8s-admin&quot;
  ],
  &quot;preferred_username&quot;: &quot;dummy-username&quot;,
  &quot;given_name&quot;: &quot;Firstname1&quot;,
  &quot;family_name&quot;: &quot;Lastname1&quot;,
  &quot;email&quot;: &quot;me@example.com&quot;
}
</code></pre>
<p>When I try to login with the token of a generated service account (from kubernetes) everything works fine.</p>
<h2>additional Information</h2>
<p>The environment was set up via Kubespray and the API server parameters specified in the following way:</p>
<pre><code>kube_oidc_url: https://192.168.178.25:8443/auth/realms/master
kube_oidc_client_id: account
kube_oidc_ca_file: &quot;{{ kube_cert_dir }}/keycloak-rootCA.pem&quot;
kube_oidc_username_claim: sub
kube_oidc_groups_claim: groups
#kube_oidc_username_prefix: &quot;oidc:&quot;
#kube_oidc_groups_prefix: &quot;oidc:&quot;
</code></pre>
<p>Thanks for your help.</p>

chresse
<p>The issue was that Kubespray did not overtake my settings into the Pod spec of the api-server (/etc/kubernetes/manifests/kube-apiserver.yaml). When I added the parameters in the Pod spec of each api-server (I have a multi master setup), it worked as expected:</p>

<pre><code>- --oidc-issuer-url=https://192.168.178.25:8443/auth/realms/master
- --oidc-client-id=account
- --oidc-username-claim=email
- '--oidc-username-prefix=oidc:'
- --oidc-groups-claim=groups
- '--oidc-groups-prefix=oidc:'
- --oidc-ca-file=/etc/kubernetes/ssl/keycloak-rootCA.pem
</code></pre>
