Red Hat OpenShift Container Platform

Sample GitHub CR

Review the custom resource fields and acceptable values for configuring a GitHub identity provider in Red Hat OpenShift Container Platform. Use these definitions to set client credentials and access restrictions before applying the configuration to the cluster.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: githubidp
    mappingMethod: claim
    type: GitHub
    github:
      ca:
        name: ca-config-map
      clientID: {...}
      clientSecret:
        name: github-secret
      hostname: ...
      organizations:
      - myorganization1
      - myorganization2
      teams:
      - myorganization1/team-a
      - myorganization2/team-b

where:

spec.identityProviders.name

Specifies the provider name, which is prefixed to the GitHub numeric user ID to form an identity name. It is also used to build the callback URL.

spec.identityProviders.mappingMethod

Specifies how mappings are established between identities from this provider and User objects.

spec.identityProviders.github.ca

Specifies an optional reference to an Red Hat OpenShift Container Platform ConfigMap object containing the PEM-encoded certificate authority bundle to use in validating server certificates for the configured URL. Only for use in GitHub Enterprise with a non-publicly trusted root certificate.

spec.identityProviders.github.clientID

Specifies the client ID issued when you register a GitHub OAuth application. The application must be configured with a callback URL of https://oauth-openshift.apps.<cluster-name>.<cluster-domain>/oauth2callback/<idp-provider-name>.

spec.identityProviders.github.clientSecret

Specifies a reference to an Red Hat OpenShift Container Platform Secret object containing the client secret issued by GitHub.

spec.identityProviders.github.hostname

Specifies the hostname of your GitHub Enterprise instance, such as example.com. This value must match the GitHub Enterprise hostname value in the /setup/settings file and cannot include a port number. If this value is not set, then either teams or organizations must be defined. For GitHub, omit this parameter.

spec.identityProviders.github.organizations

Specifies the list of organizations. Either the organizations or teams field must be set unless the hostname field is set, or if mappingMethod is set to lookup. Cannot be used in combination with the teams field.

spec.identityProviders.github.teams

Specifies the list of teams. Either the teams or organizations field must be set unless the hostname field is set, or if mappingMethod is set to lookup. Cannot be used in combination with the organizations field.

If organizations or teams is specified, only GitHub users that are members of at least one of the listed organizations are allowed to log in. If the GitHub OAuth application configured in clientID is not owned by the organization, an organization owner must grant third-party access to use this option. This can be done during the first GitHub login by the administrator of the organization, or from the GitHub organization settings.