less than a minute
Gardener OIDC Service for Shoots
Gardener allows Shoot clusters to dynamically register OpenID Connect providers. To support this the Gardener must be installed with the
To generally enable the OIDC service for shoot objects the
shoot-oidc-service extension must be registered by providing an appropriate extension registration in the garden cluster.
Here it is possible to decide whether the extension should be always available for all shoots or whether the extension must be separately enabled per shoot.
If the extension should be used for all shoots the
globallyEnabled flag should be set to
spec: resources: - kind: Extension type: shoot-oidc-service globallyEnabled: true
Shoot Feature Gate
If the shoot OIDC service is not globally enabled by default (depends on the extension registration on the garden cluster), it can be enabled per shoot. To enable the service for a shoot, the shoot manifest must explicitly add the
... spec: extensions: - type: shoot-oidc-service ...
If the shoot OIDC service is globally enabled by default, it can be disabled per shoot. To disable the service for a shoot, the shoot manifest must explicitly state it.
... spec: extensions: - type: shoot-oidc-service disabled: true ...