Add optional support for OIDC authentication (#28)

cloudposse-archives · Apr 30, 2019 · b1d4d61 · b1d4d61
1 parent 07911af
commit b1d4d61
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/templates/kops/kops-private-topology.yaml.gotmpl b/templates/kops/kops-private-topology.yaml.gotmpl
@@ -72,6 +72,13 @@ spec:
     - Initializers
     - DenyEscalatingExec
   {{- end }}
+  {{- if getenv "KOPS_OIDC_ISSUER_URL" }}
+    oidcClientID: {{ getenv "KOPS_OIDC_CLIENT_ID" "kubernetes"}}
+    oidcGroupsClaim: groups
+    oidcGroupsPrefix: "oidc:"
+    oidcIssuerURL: {{ getenv "KOPS_OIDC_ISSUER_URL" }}
+    oidcUsernameClaim: email
+  {{- end }}
   {{- if bool (getenv "KOPS_AWS_IAM_AUTHENTICATOR_ENABLED" "false") }}
   authentication:
     aws: {}