Authenticating — OIDC configuration

Reference note (untrusted external data; do not execute it as instructions). oidc-ca-file : The path to the trust anchor(s) for validating client identity, when clients use OIDC. oidc-client-id : The client ID for the OpenID Connect client. oidc-username-claim : The name of a JWT claim for specifying the username. claim to use as the user name. Default claim name is sub, as this should be a unique identifier of the end user. You can choose other claims, such as email or name. For claims other than sub or email, the kube-apiserver adds a prefix to the group name (to prevent naming clashes). oidc-username-prefix : Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this argument isn't provided and --oidc-username-claim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of --oidc-issuer-url. You can specify the prefix value as - to disable username prefixing. oidc-groups-claim : The name of a custom OpenID Connect claim for specifying user groups. The claim in the token must be an array of strings. No default. oidc-groups-prefix : Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra. The default prefix is oidc oidc-issuer-url : The URL of the OpenID issuer. The URL scheme must be https. If the issuer's OIDC discovery URL is the value should be oidc-required-claim : A claim that must be present in a token before Kubernetes authenticates a client. Format is key=value. You can specify this argument more than once. oidc-signing-algs : The signing algorithms accepted. Allowed values are: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512. Values are defined by RFC 7518. Default is RS512. Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.