kubernetes oidc登录忽略组

Question

我正在使用keycloak验证与kubernetes使用kube代理和oidc-登录。

我用keycloak创建了一个客户端，并使用以下配置创建了一个映射器。

​

kube-oidc-代理正在使用以下配置运行：

command: ["kube-oidc-proxy"]
args:
  - "--secure-port=443"
  - "--tls-cert-file=/etc/oidc/tls/crt.pem"
  - "--tls-private-key-file=/etc/oidc/tls/key.pem"
  - "--oidc-client-id=$(OIDC_CLIENT_ID)"
  - "--oidc-issuer-url=$(OIDC_ISSUER_URL)"
  - "--oidc-username-claim=$(OIDC_USERNAME_CLAIM)"
  - "--oidc-signing-algs=$(OIDC_SIGNING_ALGS)"
  - "--oidc-username-prefix='oidcuser:'"
  - "--oidc-groups-claim=groups"
  - "--oidc-groups-prefix='oidcgroup:'"
  - "--v=10"

kube配置具有以下配置：

apiVersion: v1
clusters:
- cluster:
    server: <KUBE_OIDC_PROXY_URL>
  name: default
contexts:
- context:
    cluster: default
    namespace: default
    user: oidc
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: oidc
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - oidc-login
      - get-token
      - -v10
      - --oidc-issuer-url=<ISSUER_URL>
      - --oidc-client-id=kube-oidc-proxy
      - --oidc-client-secret=<CLIENT_SECRET>
      - --oidc-extra-scope=email
      - --grant-type=authcode
      command: kubectl
      env: null
      provideClusterInfo: false

我可以成功地获得jwt令牌中包含组的用户信息，如下所示：

 "name": "Test Uset",
  "groups": [
    "KubernetesAdmins"
  ],
  "preferred_username": "test-user",
  "given_name": "Test",
  "family_name": "Uset",
  "email": "testuser@test.com"

我创建了以下集群角色绑定：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: oidc-admin-group
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: oidcgroup:KubernetesAdmins

但是，我仍然得到了如下禁止的错误：

Error from server (Forbidden): pods is forbidden: User "'oidcuser:'ecc4d1ac-68d7-4158-8a58-40b469776c07" cannot list resource "pods" in API group "" in the namespace "default"

关于如何解决这个问题，有什么想法吗？

提前谢谢，

Answer 1

我想通了。从用户和组前缀中删除单引号如下：

"--oidc-username-prefix=oidcuser:"
--oidc-groups-prefix=oidcgroup:"

这解决了这个问题。