Add docs for gke with oidc on headlamp #3577
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ashu8912 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/L
There was a problem hiding this comment.
Pull Request Overview
This PR adds documentation for setting up a GKE cluster with OIDC authentication using Headlamp.
- Adds a new “Cloud Provider Specific Guides” section linking to EKS, GKE, and AKS tutorials.
- Introduces a comprehensive GKE tutorial covering Google Identity Platform configuration, cluster setup, RBAC, and Helm deployment.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| docs/installation/in-cluster/index.md | Added Cloud Provider Specific Guides section with links to OIDC guides |
| docs/installation/in-cluster/gke/index.md | New tutorial for Headlamp on GKE with Google Identity Platform |
Comments suppressed due to low confidence (3)
docs/installation/in-cluster/index.md:102
- [nitpick] The link text “GKE with OIDC” may imply a generic OIDC setup, but this guide is specific to Google Identity Platform. Consider renaming it to “GKE with Google Identity Platform” for clarity.
- **[GKE with OIDC](./gke/)** - Google Kubernetes Engine with OIDC providers
docs/installation/in-cluster/gke/index.md:70
- The
--zoneflag in the existing cluster update command is missing the closing>bracket; it should be--zone=<YOUR_ZONE>.
--zone=<YOUR_ZONE \
docs/installation/in-cluster/gke/index.md:88
- In the
ClientConfigYAML example, the sequence item- name: oidcmust be indented under theauthentication:key (e.g., two spaces deeper) to produce valid YAML.
- name: oidc
There was a problem hiding this comment.
I was working though this and noticed the warning:
Caution: Starting on July 1, 2025, new Google Cloud organizations that you create won't support Identity Service for GKE.
https://cloud.google.com/kubernetes-engine/docs/how-to/oidc
It looks like they are moving folks to "Workforce Identity Federation".
Should we still have this tutorial? I guess for some time existing users of the identity service might want to use it. If we keep this tutorial, we should add a warning to the top that Identity service is being phased out.
If we're going to keep it, I'll continue the review. Let me know @ashu8912 ?
|
|
||
| ```bash | ||
| gcloud container clusters update ashu-headlamp \ | ||
| --zone=<YOUR_ZONE \ |
| name: your-cluster-name | ||
| server: https://your-cluster-ip:443 | ||
| ``` | ||
|
|
There was a problem hiding this comment.
I think adding references or further reading could help.
Maybe link to the appropriate section of this doc here? https://cloud.google.com/kubernetes-engine/docs/how-to/oidc
| name: oidc-admin-binding | ||
| subjects: | ||
| - kind: User | ||
| name: [email protected] |
There was a problem hiding this comment.
example.com should be used for example domains generally.
What about? [email protected]
| issuerURI: "https://accounts.google.com" | ||
| kubectlRedirectURI: "http://localhost:8080/oidc-callback" | ||
| scopes: "openid,email,profile" | ||
| userClaim: email |
There was a problem hiding this comment.
I think this should match the RBAC config?
| kubectlRedirectURI: "http://localhost:8080/oidc-callback" | ||
| scopes: "openid,email,profile" | ||
| userClaim: email | ||
| userPrefix: 'oidc:' |
There was a problem hiding this comment.
This is so you don't need to write? name: oidc:[email protected]
| |---------|-------| | ||
| | Issuer URL | `https://accounts.google.com` | | ||
| | Username Claim | `email` | | ||
| | Groups Claim | `groups` (if using Google Workspace) | |
There was a problem hiding this comment.
I tried to find docs for a groups claim, but couldn't. Do you have a pointer for documentation for this?
It's only available for Google Workspace? Can you please add some detail here?
| - [kubectl](https://kubernetes.io/docs/tasks/tools/) installed | ||
| - [Helm](https://helm.sh/docs/intro/install/) installed | ||
|
|
||
| ## Step 1: Configure Google Identity Platform |
There was a problem hiding this comment.
Based on https://cloud.google.com/kubernetes-engine/docs/how-to/oidc#external-idp-authentication-methods, identity service is not recommended. They prefer Workforce Identity Federation
k8s-ci-robot
added
the
do-not-merge/work-in-progress
This PR adds documentation for setting up a gke cluster and enabling identity service on it and oidc configuration setup with headlamp