Red Hat OpenShift Container Platform

Sample Google custom resource

Review the custom resource (CR) fields and acceptable values for configuring a Google identity provider in Red Hat OpenShift Container Platform. Use these definitions to set client credentials and hosted domain restrictions before applying the configuration to the cluster.

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: googleidp
    mappingMethod: claim
    type: Google
    google:
      clientID: {...}
      clientSecret:
        name: google-secret
      hostedDomain: "example.com"

where:

spec.identityProviders.name: Specifies the provider name, which is prefixed to the Google numeric user ID to form an identity name. The provider name is also used to build the redirect URL.
spec.identityProviders.mappingMethod: Specifies how mappings are established between identities from this provider and User objects.
spec.identityProviders.google.clientID: Specifies the client ID from the Google Cloud project where you create the OAuth client. The project must be configured with a redirect URI of https://oauth-openshift.apps.<cluster-name>.<cluster-domain>/oauth2callback/<idp-provider-name>.
spec.identityProviders.google.clientSecret: Specifies a reference to an Red Hat OpenShift Container Platform Secret object containing the client secret issued by Google.
spec.identityProviders.google.hostedDomain: Specifies a hosted domain used to restrict sign-in accounts. Optional if the lookup mappingMethod is used. If empty, any Google account is allowed to authenticate.