{"payload":{"allShortcutsEnabled":false,"fileTree":{"k8s-tools/keycloak":{"items":[{"name":"README.md","path":"k8s-tools/keycloak/README.md","contentType":"file"},{"name":"certificate.yml","path":"k8s-tools/keycloak/certificate.yml","contentType":"file"},{"name":"group-cluster-role-binding.yml","path":"k8s-tools/keycloak/group-cluster-role-binding.yml","contentType":"file"},{"name":"issuer.yml","path":"k8s-tools/keycloak/issuer.yml","contentType":"file"},{"name":"keycloak-values.yml","path":"k8s-tools/keycloak/keycloak-values.yml","contentType":"file"},{"name":"user-cluster-role-binding.yml","path":"k8s-tools/keycloak/user-cluster-role-binding.yml","contentType":"file"}],"totalCount":6},"k8s-tools":{"items":[{"name":"crossplane","path":"k8s-tools/crossplane","contentType":"directory"},{"name":"keycloak","path":"k8s-tools/keycloak","contentType":"directory"},{"name":"tilt","path":"k8s-tools/tilt","contentType":"directory"}],"totalCount":3},"":{"items":[{"name":"cloud","path":"cloud","contentType":"directory"},{"name":"clusters","path":"clusters","contentType":"directory"},{"name":"external-dns","path":"external-dns","contentType":"directory"},{"name":"iac","path":"iac","contentType":"directory"},{"name":"k3s","path":"k3s","contentType":"directory"},{"name":"k8s-tools","path":"k8s-tools","contentType":"directory"},{"name":"monitoring","path":"monitoring","contentType":"directory"},{"name":"semaphore-kubespray","path":"semaphore-kubespray","contentType":"directory"},{"name":".gitignore","path":".gitignore","contentType":"file"},{"name":"README.md","path":"README.md","contentType":"file"}],"totalCount":10}},"fileTreeProcessingTime":4.183552,"foldersToFetch":[],"repo":{"id":625993057,"defaultBranch":"main","name":"kubernetes","ownerLogin":"morrismusumi","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2023-04-10T15:09:53.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/31651049?v=4","public":true,"private":false,"isOrgOwned":false},"codeLineWrapEnabled":false,"symbolsExpanded":false,"treeExpanded":true,"refInfo":{"name":"main","listCacheKey":"v0:1681139650.0","canEdit":false,"refType":"branch","currentOid":"40d8785a78fa92e27c939ec3fa3e3eeca5eeeac8"},"path":"k8s-tools/keycloak/README.md","currentUser":null,"blob":{"rawLines":null,"stylingDirectives":null,"colorizedLines":null,"csv":null,"csvError":null,"dependabotInfo":{"showConfigurationBanner":false,"configFilePath":null,"networkDependabotPath":"/morrismusumi/kubernetes/network/updates","dismissConfigurationNoticePath":"/settings/dismiss-notice/dependabot_configuration_notice","configurationNoticeDismissed":null},"displayName":"README.md","displayUrl":"https://github.com/morrismusumi/kubernetes/blob/main/k8s-tools/keycloak/README.md?raw=true","headerInfo":{"blobSize":"2.52 KB","deleteTooltip":"You must be signed in to make or propose changes","editTooltip":"You must be signed in to make or propose changes","ghDesktopPath":"https://desktop.github.com","isGitLfs":false,"onBranch":true,"shortPath":"0b9028f","siteNavLoginPath":"/login?return_to=https%3A%2F%2Fgithub.com%2Fmorrismusumi%2Fkubernetes%2Fblob%2Fmain%2Fk8s-tools%2Fkeycloak%2FREADME.md","isCSV":false,"isRichtext":true,"toc":[{"level":1,"text":"OIDC Kubernetes Authentication with Keycloak","anchor":"oidc-kubernetes-authentication-with-keycloak","htmlText":"OIDC Kubernetes Authentication with Keycloak"},{"level":3,"text":"Create CA, Issuer and Keycloak Certificate","anchor":"create-ca-issuer-and-keycloak-certificate","htmlText":"Create CA, Issuer and Keycloak Certificate"},{"level":3,"text":"Install Keycloak","anchor":"install-keycloak","htmlText":"Install Keycloak"},{"level":3,"text":"Configure API Server","anchor":"configure-api-server","htmlText":"Configure API Server"},{"level":3,"text":"Create OIDC User","anchor":"create-oidc-user","htmlText":"Create OIDC User"},{"level":3,"text":"Set OIDC User as default for current context","anchor":"set-oidc-user-as-default-for-current-context","htmlText":"Set OIDC User as default for current context"},{"level":3,"text":"Create ClusterRoleBinding","anchor":"create-clusterrolebinding","htmlText":"Create ClusterRoleBinding"},{"level":3,"text":"Enable Audit Logs for API Server","anchor":"enable-audit-logs-for-api-server","htmlText":"Enable Audit Logs for API Server"}],"lineInfo":{"truncatedLoc":"107","truncatedSloc":"81"},"mode":"file"},"image":false,"isCodeownersFile":null,"isPlain":false,"isValidLegacyIssueTemplate":false,"issueTemplate":null,"discussionTemplate":null,"language":"Markdown","languageID":222,"large":false,"planSupportInfo":{"repoIsFork":null,"repoOwnedByCurrentUser":null,"requestFullPath":"/morrismusumi/kubernetes/blob/main/k8s-tools/keycloak/README.md","showFreeOrgGatedFeatureMessage":null,"showPlanSupportBanner":null,"upgradeDataAttributes":null,"upgradePath":null},"publishBannersInfo":{"dismissActionNoticePath":"/settings/dismiss-notice/publish_action_from_dockerfile","releasePath":"/morrismusumi/kubernetes/releases/new?marketplace=true","showPublishActionBanner":false},"rawBlobUrl":"https://github.com/morrismusumi/kubernetes/raw/main/k8s-tools/keycloak/README.md","renderImageOrRaw":false,"richText":"<article class=\"markdown-body entry-content container-lg\" itemprop=\"text\"><div class=\"markdown-heading\" dir=\"auto\"><h1 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">OIDC Kubernetes Authentication with Keycloak</h1><a id=\"user-content-oidc-kubernetes-authentication-with-keycloak\" class=\"anchor\" aria-label=\"Permalink: OIDC Kubernetes Authentication with Keycloak\" href=\"#oidc-kubernetes-authentication-with-keycloak\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Create CA, Issuer and Keycloak Certificate</h3><a id=\"user-content-create-ca-issuer-and-keycloak-certificate\" class=\"anchor\" aria-label=\"Permalink: Create CA, Issuer and Keycloak Certificate\" href=\"#create-ca-issuer-and-keycloak-certificate\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"kubectl apply -f issuer.yml\nkubectl apply -f certificate.yml\"><pre>kubectl apply -f issuer.yml\nkubectl apply -f certificate.yml</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Install Keycloak</h3><a id=\"user-content-install-keycloak\" class=\"anchor\" aria-label=\"Permalink: Install Keycloak\" href=\"#install-keycloak\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"helm repo add bitnami https://charts.bitnami.com/bitnami\nhelm upgrade —install keycloak —namespace keycloak bitnami/keycloak —reuse-values -f keycloak-values.yml\"><pre>helm repo add bitnami https://charts.bitnami.com/bitnami\nhelm upgrade —install keycloak —namespace keycloak bitnami/keycloak —reuse-values -f keycloak-values.yml</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Configure API Server</h3><a id=\"user-content-configure-api-server\" class=\"anchor\" aria-label=\"Permalink: Configure API Server\" href=\"#configure-api-server\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"# Create file with Keycloak CA certificate\nvi /etc/ssl/certs/keycloak-ca.crt\n# Edit kube-apiserver manifest\nvi /etc/kubernetes/manifests/kube-apiserver.yaml\n\n# Add below extra args to kube-apiserver command\n- —-oidc-issuer-url=YOUR_KEYCLOAK_HOSTNAME/realms/kubernetes\n- —-oidc-client-id-kubernetes\n- —-oidc-username-claim=email\n- —-oidc-groups-claim=groups\n- —-oidc-ca-file=/etc/ssl/certs/kevcloak-ca.crt\"><pre><span class=\"pl-c\"><span class=\"pl-c\">#</span> Create file with Keycloak CA certificate</span>\nvi /etc/ssl/certs/keycloak-ca.crt\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Edit kube-apiserver manifest</span>\nvi /etc/kubernetes/manifests/kube-apiserver.yaml\n\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Add below extra args to kube-apiserver command</span>\n- —-oidc-issuer-url=YOUR_KEYCLOAK_HOSTNAME/realms/kubernetes\n- —-oidc-client-id-kubernetes\n- —-oidc-username-claim=email\n- —-oidc-groups-claim=groups\n- —-oidc-ca-file=/etc/ssl/certs/kevcloak-ca.crt</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Create OIDC User</h3><a id=\"user-content-create-oidc-user\" class=\"anchor\" aria-label=\"Permalink: Create OIDC User\" href=\"#create-oidc-user\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"kubectl config set-credentials oidc-admin \\\n--exec-api-version=client.authentication.k8s.io/v1beta1 \\\n--exec-command=kubectl \\\n--exec-arg=oidc-login \\\n--exec-arg=get-token \\\n--exec-arg=--oidc-issuer-url=https://YOUR_KEYCLOAK_HOSTNAME/realms/kubernetes \\\n--exec-arg=--oidc-client-id=kubernetes \\\n--exec-arg=--oidc-extra-scope=&quot;groups email openid&quot; \\\n--exec-arg=--oidc-client-secret=CLINET SECRET \\\n--exec-arg=--insecure-skip-tls-verify\"><pre>kubectl config set-credentials oidc-admin \\\n--exec-api-version=client.authentication.k8s.io/v1beta1 \\\n--exec-command=kubectl \\\n--exec-arg=oidc-login \\\n--exec-arg=get-token \\\n--exec-arg=--oidc-issuer-url=https://YOUR_KEYCLOAK_HOSTNAME/realms/kubernetes \\\n--exec-arg=--oidc-client-id=kubernetes \\\n--exec-arg=--oidc-extra-scope=<span class=\"pl-s\"><span class=\"pl-pds\">\"</span>groups email openid<span class=\"pl-pds\">\"</span></span> \\\n--exec-arg=--oidc-client-secret=CLINET SECRET \\\n--exec-arg=--insecure-skip-tls-verify</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Set OIDC User as default for current context</h3><a id=\"user-content-set-oidc-user-as-default-for-current-context\" class=\"anchor\" aria-label=\"Permalink: Set OIDC User as default for current context\" href=\"#set-oidc-user-as-default-for-current-context\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"kubectl config set-context CONTEXT_NAME --cluster=CLUSTER_NAME --user=oidc-admin\"><pre>kubectl config set-context CONTEXT_NAME --cluster=CLUSTER_NAME --user=oidc-admin</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Create ClusterRoleBinding</h3><a id=\"user-content-create-clusterrolebinding\" class=\"anchor\" aria-label=\"Permalink: Create ClusterRoleBinding\" href=\"#create-clusterrolebinding\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"kubectl apply -f user-cluster-role-binding.yml\"><pre>kubectl apply -f user-cluster-role-binding.yml</pre></div>\n<div class=\"markdown-heading\" dir=\"auto\"><h3 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\">Enable Audit Logs for API Server</h3><a id=\"user-content-enable-audit-logs-for-api-server\" class=\"anchor\" aria-label=\"Permalink: Enable Audit Logs for API Server\" href=\"#enable-audit-logs-for-api-server\"><svg class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hidden=\"true\"><path d=\"m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z\"></path></svg></a></div>\n<div class=\"highlight highlight-source-shell notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"# Create policy directory and policy file.\nmkdir /etc/kubernetes/audit-policy\n\ncat &lt;&lt;EOF &gt; /etc/kubernetes/audit-policy/pods-audit-policy-yaml\napiVersion: audit.k8s.io/v1\nkind: Policy rules:\n   # Log pod changes at RequestResponse level\n   - level: RequestResponse \n   resources:\n      - group:\n         resources: [&quot;pods&quot;]\nEOF\n# Edit kube-apiserver manifest\nvi /etc/kubernetes/manifests/kube-apiserver.yaml\n\n# Add below volumes configuration\nvolumes: \n- hostPath:\n    path: /etc/kubernetes/audit-policy \n    type: DirectoryOrCreate\n  name: audit-policy \n- hostPath:\n    path: /var/log/audit \n    type: DirectoryOrCreate\n  name: audit-logs\n\n# Add below volume mount configuration\n\nvolumeMounts:\n- mountPath: /etc/kubernetes/audit-policy \n  name: audit-policy\n- mountPath: /var/log/audit \n  name: audit-logs\n\n# Add below extra args to kube-apiserver command\n\n- --audit-log-path=/var/log/audit/kube-apiserver-audit.log\n- --audit-policy-file=/etc/kubernetes/audit-policy/pods-audit-policy-yaml\n\"><pre><span class=\"pl-c\"><span class=\"pl-c\">#</span> Create policy directory and policy file.</span>\nmkdir /etc/kubernetes/audit-policy\n\ncat <span class=\"pl-s\"><span class=\"pl-k\">&lt;&lt;</span><span class=\"pl-k\">EOF</span> &gt; /etc/kubernetes/audit-policy/pods-audit-policy-yaml</span>\n<span class=\"pl-s\">apiVersion: audit.k8s.io/v1</span>\n<span class=\"pl-s\">kind: Policy rules:</span>\n<span class=\"pl-s\">   # Log pod changes at RequestResponse level</span>\n<span class=\"pl-s\">   - level: RequestResponse </span>\n<span class=\"pl-s\">   resources:</span>\n<span class=\"pl-s\">      - group:</span>\n<span class=\"pl-s\">         resources: [\"pods\"]</span>\n<span class=\"pl-s\"><span class=\"pl-k\">EOF</span></span>\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Edit kube-apiserver manifest</span>\nvi /etc/kubernetes/manifests/kube-apiserver.yaml\n\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Add below volumes configuration</span>\nvolumes: \n- hostPath:\n    path: /etc/kubernetes/audit-policy \n    type: DirectoryOrCreate\n  name: audit-policy \n- hostPath:\n    path: /var/log/audit \n    type: DirectoryOrCreate\n  name: audit-logs\n\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Add below volume mount configuration</span>\n\nvolumeMounts:\n- mountPath: /etc/kubernetes/audit-policy \n  name: audit-policy\n- mountPath: /var/log/audit \n  name: audit-logs\n\n<span class=\"pl-c\"><span class=\"pl-c\">#</span> Add below extra args to kube-apiserver command</span>\n\n- --audit-log-path=/var/log/audit/kube-apiserver-audit.log\n- --audit-policy-file=/etc/kubernetes/audit-policy/pods-audit-policy-yaml\n</pre></div>\n</article>","renderedFileInfo":null,"shortPath":null,"symbolsEnabled":true,"tabSize":8,"topBannersInfo":{"overridingGlobalFundingFile":false,"globalPreferredFundingPath":null,"showInvalidCitationWarning":false,"citationHelpUrl":"https://docs.github.com/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-citation-files","actionsOnboardingTip":null},"truncated":false,"viewable":true,"workflowRedirectUrl":null,"symbols":{"timed_out":false,"not_analyzed":false,"symbols":[{"name":"OIDC Kubernetes Authentication with Keycloak","kind":"section_1","ident_start":0,"ident_end":44,"extent_start":0,"extent_end":64,"fully_qualified_name":"OIDC Kubernetes Authentication with Keycloak","ident_utf16":{"start":{"line_number":0,"utf16_col":0},"end":{"line_number":0,"utf16_col":44}},"extent_utf16":{"start":{"line_number":0,"utf16_col":0},"end":{"line_number":2,"utf16_col":0}}},{"name":"Create CA, Issuer and Keycloak Certificate","kind":"section_3","ident_start":70,"ident_end":112,"extent_start":66,"extent_end":187,"fully_qualified_name":"Create CA, Issuer and Keycloak Certificate","ident_utf16":{"start":{"line_number":4,"utf16_col":4},"end":{"line_number":4,"utf16_col":46}},"extent_utf16":{"start":{"line_number":4,"utf16_col":0},"end":{"line_number":12,"utf16_col":0}}},{"name":"Install Keycloak","kind":"section_3","ident_start":191,"ident_end":207,"extent_start":187,"extent_end":388,"fully_qualified_name":"Install Keycloak","ident_utf16":{"start":{"line_number":12,"utf16_col":4},"end":{"line_number":12,"utf16_col":20}},"extent_utf16":{"start":{"line_number":12,"utf16_col":0},"end":{"line_number":19,"utf16_col":0}}},{"name":"Configure API Server","kind":"section_3","ident_start":392,"ident_end":412,"extent_start":388,"extent_end":841,"fully_qualified_name":"Configure API Server","ident_utf16":{"start":{"line_number":19,"utf16_col":4},"end":{"line_number":19,"utf16_col":24}},"extent_utf16":{"start":{"line_number":19,"utf16_col":0},"end":{"line_number":36,"utf16_col":0}}},{"name":"Create OIDC User","kind":"section_3","ident_start":845,"ident_end":861,"extent_start":841,"extent_end":1309,"fully_qualified_name":"Create OIDC User","ident_utf16":{"start":{"line_number":36,"utf16_col":4},"end":{"line_number":36,"utf16_col":20}},"extent_utf16":{"start":{"line_number":36,"utf16_col":0},"end":{"line_number":51,"utf16_col":0}}},{"name":"Set OIDC User as default for current context","kind":"section_3","ident_start":1313,"ident_end":1357,"extent_start":1309,"extent_end":1451,"fully_qualified_name":"Set OIDC User as default for current context","ident_utf16":{"start":{"line_number":51,"utf16_col":4},"end":{"line_number":51,"utf16_col":48}},"extent_utf16":{"start":{"line_number":51,"utf16_col":0},"end":{"line_number":57,"utf16_col":0}}},{"name":"Create ClusterRoleBinding","kind":"section_3","ident_start":1455,"ident_end":1480,"extent_start":1451,"extent_end":1541,"fully_qualified_name":"Create ClusterRoleBinding","ident_utf16":{"start":{"line_number":57,"utf16_col":4},"end":{"line_number":57,"utf16_col":29}},"extent_utf16":{"start":{"line_number":57,"utf16_col":0},"end":{"line_number":64,"utf16_col":0}}},{"name":"Enable Audit Logs for API Server","kind":"section_3","ident_start":1545,"ident_end":1577,"extent_start":1541,"extent_end":2580,"fully_qualified_name":"Enable Audit Logs for API Server","ident_utf16":{"start":{"line_number":64,"utf16_col":4},"end":{"line_number":64,"utf16_col":36}},"extent_utf16":{"start":{"line_number":64,"utf16_col":0},"end":{"line_number":107,"utf16_col":0}}}]}},"copilotInfo":null,"copilotAccessAllowed":false,"csrf_tokens":{"/morrismusumi/kubernetes/branches":{"post":"6hJ7MomUiLMMxLr_EKzYTZ2wSGkvazb-cHbtyNuEZpuwDsnDDzdXNk6p6s1pUwoHv3mLozw1-vOgDToeCdiqKQ"},"/repos/preferences":{"post":"Ut11jv8kT51Vz5gl7uxWXnvQPPXAgUa1j30MyHMO7ktK3ed2rC5sBavolEQt8Ult3FZX92L_Yhxr_YjsODHfvw"}}},"title":"kubernetes/k8s-tools/keycloak/README.md at main · morrismusumi/kubernetes"}