What is the purpose of the --oidc-client-id parameter when setting Kubernetes up to use OpenID Connect?

Question

The Kubernetes documentation related to OpenID Connect mentions that as part of setting things up you need to supply some parameters to the API server:

--oidc-client-id: A client id that all tokens must be issued for.

There is no other explanation about how this would map to, say, something returned by the OpenID Connect-conformant Google identity provider.

I don't know what this parameter value will be used for. Will it match against something in the decoded JWT token?

It looks like the id_token returned by the Google identity provider might contain something, once decoded, in its aud field (aud is apparently short for "audience"). Is this what the --oidc-client-id should match? Am I way off?

Answer 1

This can be explained from the kubernetes documentation on id tokens.

As you can see, identity provider is a separate system. For example this can be MS Azure AD or Google as you have shown.

When you register for a identity provider, you get important things in return. client id is one such important parameter. if you are aware of the openid connect flow, you need to provide this client id when you follow the flow. If the flow is complete, you will return an id token. An id token has one must have claim, aud which is the audience that token was issued for.

When you validate an id token you MUST verify you are in the audience list. More can be found from the spec.

Quoting from specification,

The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience

Now, kubernetes uses bearer tokens. Here the tokens used are id tokens. To validate the token it should know specifically the audience. This enables the API server to validate the token is issued for the particular client who made the call. Thus authorising the call to to success.