Elaborate on Kuberos usage

README.md

@@ -28,10 +28,35 @@ generated from a supplied template of clusters. It also details how to manually
 user and context to a cluster, and how to use kubectl.
 
 ## Usage
+Before using Kuberos you must
+[enable OIDC at the Kubernetes API server](https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens).
+Refer to [this guide](https://cloud.google.com/community/tutorials/kubernetes-auth-openid-rbac)
+for details on how to get an OIDC client ID and secret from Google.
+
 Kuberos is [published](https://hub.docker.com/r/negz/kuberos) to the Docker Hub.
 It must be configured with an OIDC issuer, client ID, and secret, as well as a
-partial `kubeconfig` file.
+partial `kubeconfig` file. For example:
+
+```bash
+export OIDC_CLIENT_ID=woo
+export OIDC_CLIENT_SECRET=supersecret
+
+echo $OIDC_CLIENT_SECRET >/tmp/cfg/secret
+cat <<EOF >/tmp/cfg/template
+apiVersion: v1
+kind: Config
+clusters:
+- name: kuberos
+  cluster:
+    certificate-authority-data: REDACTED
+    server: https://kuberos.example.org
+EOF
 
+docker run -d -p 10003:10003 -v /tmp/cfg:/cfg "negz/kuberos:latest" \
+  /kuberos https://accounts.google.com $OIDC_CLIENT_ID /cfg/secret /cfg/template
+```
+
+Kuberos supports the following arguments:
 ```bash
 $ docker run negz/kuberos:latest /kuberos --help
 usage: kuberos [<flags>] [<oidc-issuer-url>] [<client-id>] [<client-secret-file>] [<kubecfg-template>]
@@ -81,5 +106,9 @@ kubectl --context production cluster-info
 ```
 
 ## Alternatives
+OIDC helpers that run locally to setup `kubectl`:
 * https://github.com/micahhausler/k8s-oidc-helper
 * https://github.com/coreos/dex/tree/master/cmd/example-app
+
+A Kubernetes JWT webhook helper with a similar UX to Kuberos
+* https://github.com/negz/kubehook