Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/oauth/overlays/sso/console.yaml

@@ -0,0 +1,12 @@
+apiVersion: config.openshift.io/v1
+kind: Console
+metadata:
+  annotations:
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    release.openshift.io/create-only: "true"
+  name: cluster
+spec:
+  authentication:
+    logoutRedirect: https://sso.ocplab.com/realms/ocplab/protocol/openid-connect/logout?client_id=openshift&post_logout_redirect_uri=https://console-openshift-console.${SUB_DOMAIN}

cluster-config/components/oauth/overlays/sso/kustomization.yaml

@@ -0,0 +1,43 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- oidc-client-secret.yaml
+- console.yaml
+
+patches:
+  - patch: |-
+      - op: add
+        path: /spec/identityProviders/-
+        value:
+          name: LabSSO
+          mappingMethod: claim
+          type: OpenID
+          openID:
+            clientID: openshift
+            clientSecret:
+              name: oidc-client-secret
+            extraScopes:
+            - email
+            - profile
+            extraAuthorizeParameters:
+              include_granted_scopes: "true"
+            claims:
+              preferredUsername:
+              - preferred_username
+              - email
+              name:
+              - nickname
+              - given_name
+              - name
+              email:
+              - custom_email_claim
+              - email
+              groups:
+              - groups
+            issuer: https://sso.ocplab.com/realms/ocplab
+    target:
+      group: config.openshift.io
+      kind: OAuth
+      name: cluster
+      version: v1

cluster-config/components/oauth/overlays/sso/oidc-client-secret.yaml

@@ -0,0 +1,15 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: oidc-client-secret
+  namespace: openshift-config
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: oidc-client-secret
+  data:
+    - secretKey: clientSecret
+      remoteRef:
+        key: OIDC_OCPLAB