apiVersion: v1
kind: Secret
metadata:
  name: gitlab-google-oidc
  namespace: gitlab
  labels:
    app.kubernetes.io/managed-by: knoe-installer
# GitLab OmniAuth provider config for OpenID Connect via knoe-auth.
# See: https://docs.gitlab.com/ee/administration/auth/oidc.html
# Applied by etc/init_gitlab.sh --mode k8s
stringData:
  provider: |
    name: ${GITLAB_OIDC_PROVIDER_NAME}
    label: "Google Workspace"
    icon: "https://www.google.com/favicon.ico"
    args:
      name: ${GITLAB_OIDC_PROVIDER_NAME}
      scope:
        - openid
        - profile
        - email
      response_type: code
      # discovery: true triggers a one-time fetch of
      # ${issuer}/.well-known/openid-configuration at webservice boot, which
      # populates the OpenIDConnect client's host/port/scheme/endpoints.
      # Without it omniauth-openid_connect fails every callback with
      # "Could not authenticate you from OpenIDConnect because 'No host info'".
      discovery: true
      issuer: "${GITLAB_OIDC_ISSUER}"
      client_auth_method: query
      uid_field: email
      send_scope_to_token_endpoint: false
      client_options:
        identifier: "${GITLAB_OIDC_CLIENT_ID}"
        secret: "${GITLAB_OIDC_CLIENT_SECRET}"
        redirect_uri: "${GITLAB_OIDC_REDIRECT_URI}"