Open Source Summit India 2026

Kubernetes supports OIDC login, but in real life it often becomes painful: users can’t log in, TLS trust breaks with private Keycloak, usernames don’t match RBAC rules, and people end up sharing kubeconfigs or using long‑lived tokens.

In this talk I’ll show a practical way to run Kubernetes access with Keycloak: configure OIDC the right way, bind users/groups to Kubernetes RBAC, and use kubelogin (kubectl exec plugin) so tokens are short‑lived and refresh is handled automatically on the client side.
I’ll also cover the “boring” but important part: handling the Keycloak CA certificate so the login works from admin machines without manual steps.
You’ll leave with a clear checklist and a working “golden path” setup you can copy for your own clusters, that eliminate manual day‑2 steps while keeping security and auditability intact.