<p>currently I’m trying to get the the api server connected with my keycloak.</p>

<p>When I use the oidc-information from the user everything works fine, but the groups seem to be ignored
The apiserver is running with the parameter</p>

<pre><code>     --oidc-ca-file=/etc/kubernetes/ssl/ca.pem
     --oidc-client-id=kubernetes
     --oidc-groups-claim=groups
     --oidc-groups-prefix=oidc:
     --oidc-issuer-url=https://keycloak.example.com/auth/realms/master
     --oidc-username-claim=preferred_username
     --oidc-username-prefix=oidc:
</code></pre>

<p>I added a ClusterRole and ClusterRoleBinding</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: developer-role
rules:
  - apiGroups: [""]
    resources: ["namespaces","pods"]
    verbs: ["get", "watch", "list"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: developer-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: developer-role
subjects:
- kind: User
  name: "oidc:myuser"
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>and for my user “myuser” everythin works fine.</p>

<p>But when I change the ClusterRoleBinding to subjet Group</p>

<pre><code>....
subjects:
- kind: User
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...
</code></pre>

<p>I receive forbidden.</p>

<p>I tried to debug the jwt token and the group seems to be included:</p>

<pre><code>{
...
  "groups": [
    "group1",
    "group2",
    "group3"
  ],
...
}
</code></pre>

<p>Any ideas why my groups are ignored/my ClusterRoleBinding not working?</p>

Heiko
<pre><code>....
subjects:
- kind: User
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...
</code></pre>

<p>should be:</p>

<pre><code>....
subjects:
- kind: Group
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...
</code></pre>
