title: Logs when Kubernetes OpenID Connect authentication fails
body: <p>I have tried to set up Kubernetes 1.13 for OpenID Connect (OIDC) authentication as follows:</p>
  
  <ul>
  <li>installed Keycloak server</li>
  <li>added command line options <code>--oidc-issuer-url=https://my_keycloak/auth/realms/my_realm</code>, etc., to <code>kube-apiserver</code></li>
  <li>stored id token at <code>users.user.auth-provider.config.client-id</code>, etc., in kubeconfig's <code>my_user</code></li>
  </ul>
  
  <p>From my reading of the documentation <code>kubectl</code> should now be able to access the cluster as <code>my_user</code>. However, <code>kubectl get nodes</code> says:</p>
  
  <pre><code>error: You must be logged in to the server (Unauthorized)
  </code></pre>
  
  <p>And <code>curl -k https://api_server:6443/api/v2/nodes --header "Authorization: Bearer $id_token"</code> says:</p>
  
  <pre><code>{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "Unauthorized",
    "reason": "Unauthorized",
    "code": 401
  }
  </code></pre>
  
  <p><code>kubectl logs $kube_apiserver -n kube-system</code>, <code>journalctl -u kubelet.service</code>, and Keycloak's stdout are all silent. So where can I see more logging information to discern where OIDC authentication may go wrong?</p>
  
  <p><strong>UPDATE</strong> Option <a href="https://github.com/kubernetes/kubernetes/issues/22723" rel="nofollow noreferrer"><code>--v</code></a> on both the client (<code>keyctl</code>) or the server (e.g. API server) help to some degree.</p>