This message was deleted.
# kubernetesa
adamant-kite-43734
01/26/2023, 6:36 PMThis message was deleted.
m
microscopic-diamond-94749
01/26/2023, 6:46 PMdo you want to use oidc as well as rancher for authentication or is this without rancher, just RKE? I've only set up KC as a Rancher Auth Provider, but I find your question intruiging.
l
loud-daybreak-83328
01/26/2023, 6:48 PMI'm trying to use a 3rd party application that won't really work with the way rancher handles users and stuff, so it needs to point directly to the cluster. So, yes, rancher will use OIDC if people need to log into directly, but this one app would have to go around the back
m
microscopic-diamond-94749
01/26/2023, 6:54 PMI have a feeling you need to set oidc as an extra authentication method in the kubelet args somewhere, not just the oidc settings
l
loud-daybreak-83328
01/26/2023, 6:57 PMhmm. I'm not sure where that would be (I haven't seen anything online anywhere for it)...maybe other K8s distros don't need those options by default and rke does.
m
microscopic-diamond-94749
01/26/2023, 6:59 PMyes you're right, at least the k8s.io docs don't mention anything other than the params you provided
microscopic-diamond-94749
01/26/2023, 6:59 PMbut it might conflict with the rancher authentication? 🤷♂️
l
loud-daybreak-83328
01/26/2023, 6:59 PMI wouldn't be surprised about anything.
m
microscopic-diamond-94749
01/26/2023, 7:00 PMtry it with an rke cluster that isn't provisioned via rancher
l
loud-daybreak-83328
01/26/2023, 7:01 PMI think that was one of my next things to try,
m
microscopic-diamond-94749
01/26/2023, 7:01 PMthis is what I had in mind before though https://rancher.com/docs/rke/latest/en/config-options/authentication/
l
loud-daybreak-83328
01/27/2023, 11:33 AMBy any chance have you connected directly to the rancher api (through kubectl) using the oidc token rather than a Rancher token?
m
microscopic-diamond-94749
01/27/2023, 11:36 AMI haven't done that, as I mentioned we only use oidc / keycloak as the login auth provider.
l
loud-daybreak-83328
01/27/2023, 11:38 AMOk. I was just looking at this vague documentation page: https://ranchermanager.docs.rancher.com/v2.7/reference-guides/cli-with-rancher/kubectl-utility....but I think I'd still need to make a user API token, which defeats the purpose
m
microscopic-diamond-94749
01/27/2023, 11:43 AMyes, I know what you mean
microscopic-diamond-94749
01/27/2023, 11:43 AMit only means that you can refresh your rancher token with the
kubectlc
cuddly-iron-89694
11/16/2023, 4:16 PMHave you by any chance figured this out? I'm in the same situation and pretty much have the exact same symptoms as you do. The kube apiserver isn't providing any useful logs and I just get the 'must be logged in' message.
201 Views