Change of setup guide for Google OIDC

int128 / kubelogin

kubectl plugin for Kubernetes OpenID Connect authentication (kubectl oidc-login)

Apache License 2.0

1.65k stars 191 forks source link

Change of setup guide for Google OIDC #1037

Open jchmielniak opened 7 months ago

jchmielniak commented 7 months ago

Describe the question

The setup guide for Google Identity Platform is not valid anymore (no Application Type: Other)

Corrections:

Application Type: Web Application
Authorized redirect URIs
- http://localhost:8000
- http://localhost:18000 (used if the port 8000 is already in use)
(optional) use: --oidc-extra-scope=email -> then you can use email as a username in k8s role.
- necessary apiserver arg: --oidc-username-claim=email

vxav commented 6 months ago

I followed the doc and I am getting the same issue as https://github.com/int128/kubelogin/issues/156#issuecomment-1136179053. Did you not encounter this? (I'm on K3s)

AndrewSav commented 5 months ago

I was not able to get this to work with Google OIDC. Also getting error: You must be logged in to the server (Unauthorized) after performing the given steps. Mine is vanilla kubernetes on-prem cluster and Google OIDC works without kubelogin fine.

Update

Actually --oidc-extra-scope=email in OP worked for me, and now connecting successfully. Documentation definitely needs an update.