K
Q

Keycloak KubeAPI Authentication Fails

4/29/2019

enter image description here

Please refer to the above image, I am trying to access Kubernetes Clusters Using the Kubernetes API and for that purpose as mentioned in documents I am using Python Kuberentes Client, that needs a token to communicate with Kube API.

When I am trying to authenticate the user with the token added in Kube-config file by Kube login everything works fine, where token provided by Keycloak REST API results in an un-authorization error.

I would be glad if anyone could provide any insight on this issue.

-- Rajat Badjatya
jwt
keycloak
kube-apiserver
kubernetes
python

Similar Questions

Openshift Origin Security best practices
How to remove a node label with kubernetes API
Is this possible to schedule CronJob to execute on each of Kubernetes nodes?
how to connect mongodb replica set created with helm charts in k8s cluster
Cannot apply inter-pod affinity to Airflow scheduler
I get multiple Ip with my ingress ressource and don't know why or how to fix it?

1 Answer

5/8/2019

We have resolved the issue, below are our findings and their resolution:

  • There was a discrepancy in the token generated with KubeLogin client and Keycloak Rest API, issuer URL is hostname in the token generated with KubeLogin whereas in the token generated with Keycloak Rest API issuer URL is IP Address.
  • Also, In our(Keycloak instance) generated certificate, we have hostname as issuer name which might be the reason for getting un-authorization errors. We reconfigured the Keycloak with new certificates which have DNS name.
  • We had to create RBAC with cluster scope.
-- Rajat Badjatya
Source: StackOverflow