We are plannig to implement OpenID authentication to Kubernetes, Im finding a way to add oidc-issue-url to Kubernetes cluster as descibe here Kubernetes OpenID

But im unable to find cluster configuration. How can i add or edit values to Kubernetes Cluster API server using kubectl ?


You should be using kube-apiserver.

The Kubernetes API server validates and configures data for the api objects which include pods, services, replicationcontrollers, and others. The API Server services REST operations and provides the frontend to the cluster’s shared state through which all other components interact.

kube-apiserver [flags]

If using kops, run kops edit cluster and add:

    oidcIssuerURL: ISSUER_URL
    oidcClientID: YOUR_CLIENT_ID

If you are using kube-aws, add following to cluster.yaml:

         enabled: true
         issuerUrl: ISSUER_URL
         clientId: YOUR_CLIENT_ID

You can read more about setup of on here, you might also consider using Kubelogin


kube-apiserver is running as a Docker container on your master node. Therefore, the binary is within the container, not on your host system. It is started by the master's kubelet from a file located at /etc/kubernetes/manifests. kubelet is watching this directory and will start any Pod defined here as "static pods".

To configure kube-apiserver command line arguments you need to modify /etc/kubernetes/manifests/kube-apiserver.yaml on your master.

  • Hi , Thank you for your comment. im not using AWS , its a local K8s cluster with 3 worker nodes. While checking , There is no package kube-apiserver available to install. So how do i use this command . We are using CentOS 7.x . – James Arems Apr 9 '20 at 5:18
  • @JamesArems, I've edited the answer to provide a bit more details. – Crou Apr 9 '20 at 9:15
  • 1
    Thank you. Now its very clear. – James Arems Apr 9 '20 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.