apiVersion: v1
kind: Secret
metadata:
  name: gitlab-google-oidc
  namespace: gitlab
  labels:
    app.kubernetes.io/managed-by: prole-installer
# GitLab OmniAuth provider config for OpenID Connect via knoe-auth.
# See: https://docs.gitlab.com/ee/administration/auth/oidc.html
# Applied by etc/init_gitlab.sh --mode k8s
stringData:
  provider: |
    name: openid_connect
    label: "Google Workspace"
    icon: "https://www.google.com/favicon.ico"
    args:
      name: openid_connect
      scope:
        - openid
        - profile
        - email
      response_type: code
      issuer: "https://${FRONTDOOR_HOST}/auth"
      client_auth_method: query
      uid_field: email
      send_scope_to_token_endpoint: false
      client_options:
        identifier: ""       # set to OIDC client_id
        secret: ""           # set to OIDC client_secret
        redirect_uri: "https://git.${PLATFORM_DOMAIN}/users/auth/openid_connect/callback"