This error occurs when Kubernetes OIDC authentication fails to connect to or validate tokens from a Keycloak identity provider, typically due to misconfiguration, network issues, or certificate problems.
The "Keycloak integration failed" error indicates that the API server cannot authenticate users through Keycloak OIDC integration.
kubectl get pods -n kube-system kube-apiserver-<node> -o yaml | grep -A2 oidc
curl -k https://keycloak.example.com
openssl s_client -connect keycloak.example.com:443 2>/dev/null | openssl x509 -noout -dates
curl -k https://keycloak.example.com/auth/realms/kubernetes/.well-known/openid-configuration
Keycloak OIDC requires: Keycloak realm, client application, API server OIDC flags, users with RBAC roles.
Failed to connect to server: connection refused (HTTP/2)
How to fix "HTTP/2 connection refused" error in Kubernetes
missing request for cpu in container
How to fix "missing request for cpu in container" in Kubernetes HPA
error: invalid configuration
How to fix "error: invalid configuration" in Kubernetes
kubectl logs -n kube-system pod/kube-apiserver-<node> | grep -i keycloak