Change the Group Prefix

Access and change the OIDC Group Prefix

By default, kube-oidc-proxy prefixes oidc: to all group names returned for the user. For example, if the Identity Provider reports that the user belongs to the group accounting , then Dex changes this to odic:accounting.

When you refer to a group in RBAC RoleBindings and ClusterRoleBindings, you need to use the prefixed name.

If the default prefix does not work for you, change it by following these steps:

  1. Open cluster.yaml.

  2. Add the following under the kube-oidc-proxy addon configuration. Substitute <group-prefix> with the name you want to use as the group prefix.

    - name: kube-oidc-proxy
    enabled: true
    values: |
        groupsPrefix: <group-prefix>
  3. Run konvoy deploy addons, or konvoy up, if you have not deployed the cluster.

  4. If you ran konvoy deploy addons, restart the kube-oidc-proxy pod to load the updated config.

    kubectl delete pods --namespace kubeaddons