Keycloak KubeAPI Authentication Fails

4/29/2019

enter image description here

Please refer to the above image, I am trying to access Kubernetes Clusters Using the Kubernetes API and for that purpose as mentioned in documents I am using Python Kuberentes Client, that needs a token to communicate with Kube API.

When I am trying to authenticate the user with the token added in Kube-config file by Kube login everything works fine, where token provided by Keycloak REST API results in an un-authorization error.

I would be glad if anyone could provide any insight on this issue.

-- Rajat Badjatya
jwt
keycloak
kube-apiserver
kubernetes
python

1 Answer

5/8/2019

We have resolved the issue, below are our findings and their resolution:

  • There was a discrepancy in the token generated with KubeLogin client and Keycloak Rest API, issuer URL is hostname in the token generated with KubeLogin whereas in the token generated with Keycloak Rest API issuer URL is IP Address.
  • Also, In our(Keycloak instance) generated certificate, we have hostname as issuer name which might be the reason for getting un-authorization errors. We reconfigured the Keycloak with new certificates which have DNS name.
  • We had to create RBAC with cluster scope.
-- Rajat Badjatya
Source: StackOverflow