feature: Implement OIDC configuration support

[embik]

Feature Description

I would like to be able to configure OIDC for my front-proxy (shards maybe as well, but my feeling is shards should primarily be accessed by internal components, not OIDC users).

We already have this in .spec.auth.oidc.enabled in the FrontProxy object (see ref), I added that in b9eb318, but we didn't follow up on the implementation.

Proposed Solution

Translate OIDConfiguration struct into flags for the kcp or kcp-front-proxy binary and pass them as part of the updated object.

Alternative Solutions

No response

Want to contribute?

• I would like to work on this issue.

Additional Context

No response

[mjudeikis]

We need it on shards too as they are validating oidc provider validity too. so every compont with exception of cache server

[embik]

Are you sure? I don't think this is the case. You can configure shard OIDC flags but they are only validated against direct requests afaik, front-proxied requests are authenticated by front-proxy and it sets headers including user information.

That being said, ofc we can/should implement it for shards too, I just see it as low priority.