Test Structured Authentication Configuration

control-plane/roles/gardener/defaults/main/virtual_garden.yaml

@@ -15,6 +15,7 @@ gardener_etcd_resources:
     cpu: 800m
     memory: 8Gi
 
+gardener_virtual_api_authentication_config:
 gardener_virtual_api_oidc_issuer_url:
 gardener_virtual_api_oidc_client_id:
 gardener_virtual_api_oidc_username_claim:

control-plane/roles/gardener/files/kube-apiserver/templates/configmap-authentication-config.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.authenticationConfig }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentication-config
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+data:
+  config.yaml: {{ .Values.authenticationConfig }}
+{{- end }}

control-plane/roles/gardener/files/kube-apiserver/templates/deployment-kube-apiserver.yaml

@@ -93,6 +93,9 @@ spec:
         - --etcd-keyfile=/srv/kubernetes/etcd/client/tls.key
         - --etcd-servers={{ .Values.etcd.main.endpoints }}
         - --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
+{{ if .Values.authenticationConfig }}
+        - --authentication-config=/src/kubernetes/authentication-config/config.yaml
+{{ end }}
 {{ if and .Values.oidc.issuerURL .Values.oidc.clientID }}
         - --oidc-issuer-url={{ .Values.oidc.issuerURL }}
         - --oidc-client-id={{ .Values.oidc.clientID }}
@@ -188,6 +191,10 @@ spec:
         - name: ca-oidc
           mountPath: /srv/kubernetes/oidc-ca
         {{- end }}
+        {{- if .Values.authenticationConfig}}
+        - name: authentication-config
+          mountPath: /srv/kubernetes/authentication-config
+        {{- end }}
       - name: kube-controller-manager
         image: {{ index .Values.images "controllermanager" }}
         imagePullPolicy: IfNotPresent
@@ -266,3 +273,8 @@ spec:
       - name: kube-aggregator
         secret:
           secretName: garden-kube-aggregator
+      {{- if .Values.authenticationConfig}}
+      - name: authentication-config
+        configMap:
+          name: authentication-config
+      {{- end }}

control-plane/roles/gardener/files/kube-apiserver/values.yaml

@@ -23,6 +23,8 @@ apiServer:
   hostname: 127.0.0.1
   serviceName: garden-kube-apiserver
 
+authenticationConfig:
+
 oidc:
   issuerURL:
   clientID:

control-plane/roles/gardener/templates/kube-apiserver-values.j2

@@ -7,6 +7,11 @@ apiServer:
   hostname: {{ gardener_virtual_api_server_public_dns }}
   serviceName: garden-kube-apiserver
 
+{% if gardener_virtual_api_authentication_config %}
+authenticationConfig: |
+    {{ gardener_virtual_api_authentication_config | indent(width=4, first=false) }}
+{% endif %}
+
 oidc:
   issuerURL: {% if gardener_virtual_api_oidc_issuer_url %}{{ gardener_virtual_api_oidc_issuer_url }}{% endif %}