Change the Group Prefix

By default, kube-oidc-proxy prefixes oidc: to all group names returned for the user. For example, if the Identity Provider reports that the user belongs to the group accounting , then Dex changes this to odic:accounting.

When you refer to a group in RBAC RoleBindings and ClusterRoleBindings, you need to use the prefixed name.

If the default prefix does not work for you, change it by following these steps:

1. Open cluster.yaml.

2. Add the following under the kube-oidc-proxy addon configuration. Substitute <group-prefix> with the name you want to use as the group prefix.

   - name: kube-oidc-proxy
   enabled: true
   values: |
       oidc:
       groupsPrefix: <group-prefix>
   

3. Run konvoy deploy addons, or konvoy up, if you have not deployed the cluster.

4. If you ran konvoy deploy addons, restart the kube-oidc-proxy pod to load the updated config.

   kubectl delete pods --namespace kubeaddons --selector=app.kubernetes.io/name=kube-oidc-proxy