Kubernetes OIDC:忽略组？

Question

目前，我正在尝试将api服务器与我的keycloak连接起来。

当我使用来自用户的oidc-information时，一切工作正常，但是组似乎被忽略了apiserver正在使用参数运行

     --oidc-ca-file=/etc/kubernetes/ssl/ca.pem
     --oidc-client-id=kubernetes
     --oidc-groups-claim=groups
     --oidc-groups-prefix=oidc:
     --oidc-issuer-url=https://keycloak.example.com/auth/realms/master
     --oidc-username-claim=preferred_username
     --oidc-username-prefix=oidc:

我添加了一个ClusterRole和ClusterRoleBinding

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: developer-role
rules:
  - apiGroups: [""]
    resources: ["namespaces","pods"]
    verbs: ["get", "watch", "list"]

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: developer-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: developer-role
subjects:
- kind: User
  name: "oidc:myuser"
  apiGroup: rbac.authorization.k8s.io

对于我的用户“myuser”，一切正常。

但是当我将ClusterRoleBinding更改为subjet Group时

....
subjects:
- kind: User
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...

我收到了禁止的。

我尝试调试jwt令牌，组似乎包括在内：

{
...
  "groups": [
    "group1",
    "group2",
    "group3"
  ],
...
}

你知道为什么我的组被忽略了/我的ClusterRoleBinding不工作了吗？

Answer 1

....
subjects:
- kind: User
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...

应该是：

....
subjects:
- kind: Group
  name: "oidc:group1"
  apiGroup: rbac.authorization.k8s.io
...