How to authenticate with Active Directory

[jackchuong]

Hi all,
I have a K3S single node cluster , installed on Ubuntu 22.10 VM
curl -sfL https://get.k3s.io | sh -s - --disable=servicelb,traefik,local-storage
I use MetalLB , ingress nginx and nfs-subdir-external-provisioner for storage
I attempt to install Dex and Gangway (by Helm chart) so my domain users can login "https://kubectl.k3s-hq.mydomain.com" (Gangway) and get kubeconfig themself and then access to K8S cluster.
To do that I have to edit api server manifest to add these

        --oidc-issuer-url=https://auth.k3s-hq.mydomain.com #Dex
        --oidc-client-id=oidc-auth-client
        --oidc-ca-file=/etc/kubernetes/pki/letsencrypt.pem #dex&gangway ingress will use letsencrypt certs
        --oidc-username-claim=email
        --oidc-groups-claim=groups

But whenever I tried

curl -sfL https://get.k3s.io | sh -s - --disable=servicelb,traefik,local-storage --kube-apiserver-arg="oidc-issuer-url=https://auth.k3s-hq.mydomain.com"
[INFO]  Finding release for channel stable
[INFO]  Using v1.27.4+k3s1 as release
[INFO]  Downloading hash https://github.com/k3s-io/k3s/releases/download/v1.27.4+k3s1/sha256sum-amd64.txt
[INFO]  Skipping binary downloaded, installed k3s matches hash
[INFO]  Skipping installation of SELinux RPM
[INFO]  Skipping /usr/local/bin/kubectl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/crictl symlink to k3s, already exists
[INFO]  Skipping /usr/local/bin/ctr symlink to k3s, already exists
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s.service
[INFO]  systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO]  systemd: Starting k3s
Job for k3s.service failed because the control process exited with error code.
See "systemctl status k3s.service" and "journalctl -xeu k3s.service" for details.

journalctl -xeu k3s.service
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit k3s.service has entered the 'failed' state with result 'exit-code'.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 1800 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 1822 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 7656 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 7838 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 12523 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 12555 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 12585 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 17144 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 28084 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 28922 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 28996 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 29108 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 59292 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 59392 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 575425 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 581952 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 594281 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 596589 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 596728 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 596754 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 605845 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 607927 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 612510 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Unit process 614631 (containerd-shim) remains running after unit stopped.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: Failed to start Lightweight Kubernetes.
░░ Subject: A start job for unit k3s.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit k3s.service has finished with a failure.
░░
░░ The job identifier is 7636 and the job result is failed.
Sep 07 12:00:36 k3s-hq-master1 systemd[1]: k3s.service: Consumed 1.222s CPU time.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit k3s.service completed and consumed the indicated resources.

I tried edit /etc/systemd/system/k3s.service and restart service
ExecStart=/usr/local/bin/k3s
server
'--disable=servicelb,traefik,local-storage'
'--kube-apiserver-arg=oidc-issuer-url=https://auth.k3s-hq.mydomain.com'
...
systemctl daemon-reload
Still not work.
Please give me some advice, thank you very much.

[brandond]

There's not enough info here to figure out what's going on. Please attach (not paste) the complete logs from the k3s journald log: journalctl -u k3s &> k3s.log

[jackchuong]

Hi brandond,
Thank you very much for you reply, I figure out issue, after check k3s.log I see these errors:

Error: oidc-issuer-url and oidc-client-id should be specified together
Error: open /etc/kubernetes/pki/letsencrypt.pem: no such file or directory

I have 1 more question, what better option to implement Active Directory/LDAP authentication for k8s : Dex+Gangway or Keycloak+kube-oidc-proxy ?

[brandond]

Where are you taking your example configuration from? It sounds like you're missing some values, and others point at files that don't exist on your node.

I don't have any recommendations on which is better.