Kubernetes OIDC That Works in Practice: Keycloak + RBAC + Kubelogin Without Day‑2 Pain
summary
Configures Kubernetes API with OIDC args (client_id, issuer URL, CA cert) and uses Keycloak + RBAC + kubelogin so logins return 5-minute tokens that kubelogin caches and refreshes on the client. Demo creates a Keycloak user, adds them to a group mapped to a clusterrolebinding, shows token decoding (preferred_username, groups, aud, exp) and proves immediate access and instant offboarding (remove from group → access revoked in seconds). Notes common failures: wrong CA/realm, missing group mappings, and client‑side cache location.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:06Identity access gaps
- 3:13Keycloak identity and groups
- 4:16OIDC flow with Keycloak
- 7:09JWT tokens and RBAC
- 9:37Keycloak groups to RBAC
- 10:38kubelogin token management
- 12:23Engineer onboarding/offboarding
- 15:17Demo and kubeconfig issues
- 18:50kubelogin OIDC config
- 20:19Keycloak users and groups
- 21:51Access with OIDC tokens
- 22:34JWT claims validation
- 23:18Revoking access
- 26:00Implementation issues
- 27:03Secure OIDC benefits
- 28:09Q&A
related talks
41mKubernetes Auth and Access Control
30mKubernetes RBAC at scale without losing your sanity
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
59mKubernetes access control in the enterprise
32mStop giving root access and start securing your Kubernetes clusters instead
01h 59mBuilding Secure Kubernetes Clusters with Identity Management
33mHow the Basics Of Kubernetes Auth Scale For Organizations
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions