kube-apiserver: Add oidc-required-claim flag

[jmthvt]

This PR adds the oidc-required-claim flag for kube-apiserver, that has been released in Kubernetes 1.11.

This would work if we specify one key-value claim, however it would fail for more than one pair.
This is due to the implementation of this flag. More info in this PR https://github.com/kubernetes/kubernetes/pull/62136/files

I am not sure what would be the best approach? Any input is welcome.

EDIT: Should be all good now!

[k8s-ci-robot]

Hi @jeyglk. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jmthvt]

/assign @geojaz

[gambol99]

Left the one comment just to check ..

[gambol99]

Has this been tested with multiple claims?

The documentation

--oidc-required-claim mapStringString
  | A key=value pair that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value. Repeat this flag to specify multiple claims.

i.e. the Repeat this flag to specify multiple claims ... but the default of the flagbuilder reflection which converts the struct to command line args is to append map[string]string like --node-labels=k1=v1,k2=v2 etc

If it's not supported perhaps use a slice and add the repeat tag to the annotation

[jmthvt]

Yes, the flag doesn't support multiple claims. Thanks for the suggestion, that makes sense. Will try 👍

[jmthvt]

@gambol99 comment addressed, PTAL

[chrislovecnm]

/ok-to-test

@geojaz are we still generating the api docs?

[jmthvt]

/test pull-kops-e2e-kubernetes-aws

[gambol99]

/test pull-kops-e2e-kubernetes-aws

[gambol99]

/lgtm

[gambol99]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gambol99, jeyglk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [gambol99]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment