Set OpenID Connect (OIDC) authentication

Available in VPC

You can add OpenID Connect (OIDC) provider as an authentication method of the Ncloud Kubernetes Service cluster, and grant permissions by configuring the role and authority of OIDC authentication users.

Set OIDC authentication

• Mandatory information
  • Issuer URL: URL of OIDC provider for API server to search the public signature key. Only URLs that use https:// format are allowed. Generally it is the search URL of OIDC provider without a path (e.g., https://oidc.example.com or https://login.example.com). This URL must indicate a level lower than .well-known/openid-configuration, and be able to access through Internet.
  • Client ID: Client ID of OIDC provider
• Additional information
  • Username claim: The claim used as the user’s username. Default value is sub. To prevent conflicts with other plugins, for claims except email, Issuer URL is attached as a prefix.
  • Groups claim: JWT claim used as groups of the user. If there is a claim, it must be a string array.
  • Username prefix: to prevent conflicts with the existing usernames (e.g., system:users), a prefix is attached in front of the Username claim. For example, the value oidc: creates usernames such as oidc:jane.doe. If no Username prefix is assigned and the Username claim is not email, default value of prefix is (Issuer URL)#. Set as - to do not use any prefixes.
  • Groups prefix: to prevent conflicts with the existing groups (e.g., system:group), a prefix is attached in front of Groups claim. For example, the value oidc: creates group names such as oidc:developers and oidc:tester.
  • Required claim: key=value pair that assigns required claims to ID token. If set, it checks whether there is a matching claim in ID token. Divide using ‘ ,’ to assign multiple claims.

1. Go to Kubernetes Service > Cluster > Cluster description > OpenID Connect (OIDC) and click the [Edit] button.
2. Change the status to [Set] and enter OIDC authentication information.
3. Press the [OK] button to change the cluster status to the [Setting is in progress] and perform OIDC authentication setting.
4. Once the OIDC authentication setting is completed, the cluster status is changed to [Running].

Remove OIDC authentication

1. Go to Kubernetes Service > Cluster > Cluster description > OpenID Connect (OIDC) and click the [Edit] button.
2. Change the status to [Remove] and click the [OK] button. The cluster status is changed to [Setting is in progress] and removal of OIDC authentication setting is performed.
3. Once the OIDC authentication is removed, the cluster status is changed to [Running].