<p>The <a href="https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens" rel="nofollow noreferrer">Kubernetes documentation related to OpenID Connect</a> mentions that as part of setting things up you need to supply some parameters to the API server:</p>

<pre><code>--oidc-client-id: A client id that all tokens must be issued for.
</code></pre>

<p>There is no other explanation about how this would map to, say, <a href="https://developers.google.com/identity/sign-in/web/" rel="nofollow noreferrer">something returned by the OpenID Connect-conformant Google identity provider</a>.</p>

<p>I don't know what this parameter value will be used for.  Will it match against something in the decoded JWT token?</p>

<p>It looks like the <code>id_token</code> returned by the Google identity provider might contain something, once decoded, in its <code>aud</code> field (<code>aud</code> is apparently short for "audience").  Is this what the <code>--oidc-client-id</code> should match?  Am I way off?</p>

<p>This can be explained from the kubernetes documentation on <a href="https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens" rel="nofollow noreferrer">id tokens</a>.</p>

<p>As you can see, identity provider is a separate system. For example this can be MS Azure AD or Google as you have shown. </p>

<p>When you register for a identity provider, you get important things in return. <strong><code>client id</code></strong> is one such important parameter. if you are aware of the openid connect flow, you need to provide this <strong><code>client id</code></strong> when you follow the flow. If the flow is complete, you will return an <strong><code>id token</code></strong>. An <strong><code>id token</code></strong> has one must have claim, <strong><code>aud</code></strong> which is the audience that token was issued for.</p>

<p>When you validate an <strong><code>id token</code></strong> you <strong>MUST</strong> verify you are in the audience list. More can be found from the <a href="https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation" rel="nofollow noreferrer">spec</a>.</p>

<p>Quoting from specification,</p>

<blockquote>
  <p>The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience</p>
</blockquote>

<p>Now, kubernetes  uses bearer tokens. Here the tokens used are <strong><code>id tokens</code></strong>. To validate the token it should know specifically the audience. This enables the API server to validate the token is issued for the particular client who made the call. Thus authorising the call to to success. </p>
