feat(auth): Keycloak OIDC login + RBAC for kubectl (cert kubeconfig stays break-glass)

Lets users kubectl into the cluster via Keycloak SSO, mapping realm groups to
cluster RBAC. The cert-based admin kubeconfig is untouched and remains a fully
independent break-glass path (works even if Keycloak/OIDC is down).

- keycloak-realm-import.yaml: new `kubernetes` PUBLIC client + PKCE (S256) — no
  client secret in any kubeconfig; kubelogin runs auth-code+PKCE to localhost.
  groups mapper + email/profile/roles scopes.
- k8s-oidc-rbac.yaml (NEW, platform-config): ClusterRoleBindings
  oidc:platform-admins -> cluster-admin, oidc:viewers -> view.
- k3s_server role: kube-apiserver-arg OIDC flags (issuer=homelab realm,
  client-id=kubernetes, username-claim=email + oidc: prefix, groups-claim=groups
  + oidc: prefix). No oidc-ca-file (nodes reach the issuer via the gateway VIP
  and trust the public LE cert). Applied via the rolling Restart k3s handler.

Keycloak/RBAC land via Flux now; the API-server flags take effect on the next
`ansible-playbook playbooks/k3s.yml` rolling restart (deferred until cluster load
from the VM-import incident settles).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/k3s_server/tasks/main.yml

@@ -30,7 +30,7 @@
 # its containerd config.toml (so nonroot-devices takes effect). Apply the restart
 # ROLLING, one node at a time (kube-vip keeps the API reachable; etcd quorum holds
 # at 2/3). See playbooks note: run with `serial: 1`.
-- name: Write /etc/rancher/k3s/config.yaml (tls-san + nonroot-devices)
+- name: Write /etc/rancher/k3s/config.yaml (tls-san + nonroot-devices + oidc)
   ansible.builtin.copy:
     dest: /etc/rancher/k3s/config.yaml
     owner: root
@@ -62,6 +62,22 @@
       # pod stays non-root, only the device node it already mounts follows its UID/GID.
       # Preserves the longhorn-vm RWX + Block + migratable disk contract unchanged.
       nonroot-devices: true
+
+      # OIDC (Keycloak SSO for kubectl). The API server trusts ID tokens from the homelab realm;
+      # the `kubernetes` PUBLIC client (PKCE) + kubelogin mint them, and RBAC binds the `groups`
+      # claim (platform/keycloak/k8s-oidc-rbac.yaml: oidc:platform-admins->cluster-admin,
+      # oidc:viewers->view). Nodes resolve keycloak.home.keithjackson.dev to the Cilium gateway VIP
+      # (192.168.1.53) and trust its public LE-prod cert, so NO oidc-ca-file is needed. The `oidc:`
+      # prefixes namespace federated identities away from cert / service-account subjects.
+      # ADDITIVE + break-glass-safe: the cert-based admin kubeconfig keeps full access with or
+      # without Keycloak, so a bad realm/OIDC state can never lock you out of the cluster.
+      kube-apiserver-arg:
+        - "oidc-issuer-url=https://keycloak.home.keithjackson.dev/realms/homelab"
+        - "oidc-client-id=kubernetes"
+        - "oidc-username-claim=email"
+        - "oidc-username-prefix=oidc:"
+        - "oidc-groups-claim=groups"
+        - "oidc-groups-prefix=oidc:"
   notify: Restart k3s
 
 # --- primary: found the cluster --------------------------------------------