Thanks Jerry for the info. Please have a look at the current review for this topic: https://review.opendev.org/#/c/712111/

Since I am new to this role, I’d appreciate your guidance – do you recommend adding this new info to the WIP review or should we wait and make a new review for this text?

thanks,

Mary Camp

PTIGlobal Technical Writer | maryx.camp@intel.com

From: Sun, Yicheng (Jerry) <Jerry.Sun@windriver.com>
Sent: Tuesday, March 10, 2020 4:11 PM
To: starlingx-discuss@lists.starlingx.io; Camp, MaryX <maryx.camp@intel.com>
Subject: stx docs input:2006711

Hi All,

We have just added the ability to configure oidc auth related parameters post-bootstrap:

system service-parameter-add kubernetes kube_apiserver oidc_client_id=value

system service-parameter-add kubernetes kube_apiserver oidc_groups_claim=value

system service-parameter-add kubernetes kube_apiserver oidc_issuer_url=value

system service-parameter-add kubernetes kube_apiserver oidc_username_claim=value

they used to be configurable only at boostrap time in localhost.yml:

    apiserver_oidc:

      client_id: stx-oidc-client-app

      issuer_url: https://<oam-floating-ip>:30556/dex

      username_claim: email

      groups_claim: group

Apply the service parameters with "system service-parameter-apply kubernetes", or no changes will take place.

The valid configurations for the service parameters are the same as during bootstrap:

none of the parameters or

oidc_issuer_url, oidc_client_id, oidc_username_claim or

the above 3 and oidc_groups_claim

Thanks,

Jerry