-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
4.11.z, 4.10.z, 4.8.z
-
Moderate
-
None
-
5
-
OSDOCS Sprint 241, OSDOCS Sprint 242, OSDOCS Sprint 243, OSDOCS Sprint 244, OSDOCS Sprint 245, OSDOCS Sprint 246
-
6
-
False
-
-
N/A
-
Release Note Not Required
Description of problem:
Bring Your Own OIDC keys feature is not documented
Additional info:
- HIVE-1266 implemented the support user provided service-account-signing-key and issuer.
See also the PR https://github.com/openshift/cluster-kube-apiserver-operator/pull/1006 - This feature is used by ccoctl tool during the AWS STS installation.
- The documentation should explain how to inject the bound service account signing key and the Authentication manifest with the serviceAccountIssuer
Having this feature documented will allow customers to setup OIDC integration with any external identity supporting the OpenID Connect Discovery mechanism.
