Cannot run with oidc keycloak

[nicraMarcin]

What Happened?

I try to run minikube with oidc but I doesn't work

minikube start --driver=kvm2 --embed-certs \
  --extra-config=apiserver.authorization-mode=RBAC \
  --extra-config=apiserver.oidc-issuer-url=https://keycloak.ncrm.local/realms/ncrm \
  --extra-config=apiserver.oidc-username-claim=groups \
  --extra-config=apiserver.oidc-client-id=kube

Attach the log file

logs.txt

Operating System

Ubuntu

Driver

KVM2

[pnasrat]

Note I'm just another minikube user starting to look at helping with triage.

This looks similar to the issue in #6061 as per the #6061 (comment) you have to specify all authorization-modes. I'm basing this upon looking at your logs:

W1022 13:24:53.430157    3130 manifests.go:254] the default kube-apiserver authorization-mode is "Node,RBAC"; using "RBAC"

Then from the logs you can see many issues reporting system:kube-scheduler permission errors

* E1022 13:25:00.345699       1 reflector.go:148] pkg/server/dynamic certificates/configmap_cafile_content.go:206: Failed to watch *v1.ConfigMap: failed to list *v1.ConfigMap: configmaps "extension-apiserver-authentication" is forbidden: User "system:kube-scheduler" cannot list resource "configmaps" in API group "" in the namespace "kube-system"

Could you try --extra-config=apiserver.authorization-mode=Node,RBAC although that is the default as minikube uses kubeadm as you can see here https://github.com/kubernetes/kubernetes/blob/4b48ab1fdbdeee3568790e44bea55ea719205025/cmd/kubeadm/app/phases/controlplane/manifests.go#L238 you should be able to just run:

minikube start --driver=kvm2 --embed-certs \
  --extra-config=apiserver.oidc-issuer-url=https://keycloak.ncrm.local/realms/ncrm \
  --extra-config=apiserver.oidc-username-claim=groups \
  --extra-config=apiserver.oidc-client-id=kube

[nicraMarcin]

@pnasrat Thank you, this

--extra-config=apiserver.authorization-mode=Node,RBAC

helped.
I was suggesting with official minikube Official Documentation whats why I set it.
Thanks again.