From 4f0204a9c200bb8f205e3abbfbf7e440f6a7d20b Mon Sep 17 00:00:00 2001
From: Yuqiu Wang <yuqiuw@indeed.com>
Date: Tue, 22 Feb 2022 17:53:58 -0600
Subject: [PATCH] update README with troubleshooting

---
 README.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/README.md b/README.md
index 35c02e8..db3abab 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,33 @@ To run the client, open a new terminal tab and navigate to the `/client` directo
 
 (Back to [Table of Contents](#table-of-contents))
 
+
+## Troubleshooting
+### Recommendation for keycloak configuration:
+1.  Set OIDC_URL to keycloak OpenId endpoint configuration page.
+    e.g. `OIDC_URL=https://{keycloak_domain}/realms/foo/.well-known/openid-configuration`
+    Also set `OIDC_CLIENT_ID` locally with `OIDC_CLIENT_ID={client_id}` (this is the same as `OIDC_ID`)
+2. While creating secret, use correct var name and use skooner namespace (by default it's `kube-system`):
+```
+kubectl create secret generic skooner \
+--from-literal=url="$OIDC_URL" \
+--from-literal=id="$OIDC_ID" \
+--from-literal=secret="$OIDC_SECRET" \
+--namespace=kube-system
+```
+3. following that, redeploy skooner server with
+   `kubectl apply -f https://raw.githubusercontent.com/skooner-k8s/skooner/master/kubernetes-skooner-oidc.yaml`
+
+4. Make sure skooner is running by checking `kubectl rollout status deploy/skooner --namespace=kube-system`
+   If not, report error with logging in `kubectl describe pod skooner --namespace=kube-system`
+
+5. visit skooner, check if login succeeded
+6. If not, please report both client and server error.
+   Client error: check browser console and send a screenshot
+   Server error: check logs by `kubectl logs deploy/skooner --namespace=kube-system`
+   Note that `RequestError: connect ECONNREFUSED` may indicate a configuration issue rather than Skooner's issue.
+
+
 ## License
 
 [Apache License 2.0](https://raw.githubusercontent.com/skooner-k8s/skooner/master/LICENSE)