OIDC Login

Every login to cluster tooling — kubectl, Headlamp, Argo CD, Grafana — is delegated to Keycloak, implementing [SE01 OpenID Connect Authentication] . This scenario shows the kubectl/Headlamp flow, which shares the same public PKCE client (k8s-pandur) and therefore the same RBAC mapping.

A user authenticating against the Kubernetes API via kubectl oidc-login / Headlamp, using Keycloak as the OIDC provider.
Figure 1. A user authenticating against the Kubernetes API via kubectl oidc-login / Headlamp, using Keycloak as the OIDC provider.
Motivation

Because both kubectl and Headlamp authenticate as the same OIDC client and the API server maps groups the same way for both, Headlamp never needs its own authorization logic — a user sees in Headlamp exactly what their Keycloak group membership allows them to do with kubectl. Argo CD and Grafana follow the same OIDC pattern but with their own confidential clients and role mappings (Argo CD AppProject policies, Grafana’s auth.generic_oauth).

See Single Sign-On for the full SSO concept across all four tools.