<p>We have an on-premise kubernetes deployment in our data center. I just finished deploying the pods for Dex, configured hooked up with our LDAP server to allow LDAP based authentication via Dex, ran tests and was able to retrieve the OpenID connect token for authentication.</p>
<p>Now I would like to change our on-premise k8s API server startup parameters to enable OIDC and point it to the Dex container.</p>
<p>How do I enable OIDC to the API server startup command without downtime to our k8s cluster? Was reading this doc <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/</a> but the site just says &quot;Enable the required flags&quot; without the steps</p>
<p>Thanks!</p>

<p>I installed <strong>Dex</strong> + Active Directory Integration few months ago on a cluster installed by <strong>kubeadmn</strong> .</p>
<blockquote>
<p>Let's assume that Dex is now running and it can be accessible thru
<a href="https://dex.example.com" rel="nofollow noreferrer">https://dex.example.com</a> .</p>
</blockquote>
<p>In this case,..</p>
<p>Enabling ODIC at the level of API server has 3 steps :</p>
<p>These steps have to be done on each of your Kubernetes master nodes.</p>
<p><strong>1- SSH to your master node.</strong></p>
<pre class="lang-sh prettyprint-override"><code>$ ssh root@master-ip
</code></pre>
<p><strong>2- Edit the Kubernetes API configuration.</strong></p>
<p>Add the OIDC parameters and modify the issuer URL accordingly.</p>
<pre class="lang-yaml prettyprint-override"><code>$ sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml
...
    command:
    - /hyperkube
    - apiserver
    - --advertise-address=x.x.x.x
... 

    - --oidc-issuer-url=https://dex.example.com # &lt;-- 🔴 Please focus here
    - --oidc-client-id=oidc-auth-client # &lt;-- 🔴 Please focus here
    - --oidc-username-claim=email # &lt;-- 🔴 Please focus here
    - --oidc-groups-claim=groups # &lt;-- 🔴 Please focus here
...
</code></pre>
<p><strong>3- The Kubernetes API will restart by itself.</strong></p>
<p>I recommend also to check a full guide like this <a href="https://blog.inkubate.io/access-your-kubernetes-cluster-with-your-active-directory-credentials/" rel="nofollow noreferrer">tuto</a>.</p>
