OIDC: Keycloak setup for ALB Gateway API

In the context of OIDC-based authentication using Keycloak as the provider, this article outlines the Terraform/OpenTofu stack required for setup. By leveraging the official Keycloak Terraform provider, the process is clearly explained with a focus on service-account client configuration (Client Credentials grant in OAuth 2.0) and environment variables for configuration.

The KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_BASE_PATH, KEYCLOAK_CLIENT_ID, and KEYCLOAK_CLIENT_SECRET variables are set to establish the connection. For GitHub Actions runners, a JWT-federated client is recommended, which is explained in detail.

Keycloak clients serve as the entry point for obtaining authentication tokens. The client configuration involves setting the client ID, name, access type, client authenticator type, flow types, and allowed redirect URIs. The client secret is generated to authenticate the non-public client. The standard flow is enabled, but implicit flow and other grant types are disabled. Only the scopes necessary for the client are included in the token, and only specific redirect URIs are accepted.

Client roles are assigned to limit the roles present in the token's role claim. These roles are defined in the client-specific role. Additionally, groups are created in Keycloak to manage role mappings for each user. The kube-api-client-roles.tf file defines the client-specific role, and the kube-groups.tf file maps this role to a group. Users are managed by creating Keycloak users with username and email attributes within the kube-users.tf file.