Your Kubernetes OIDC issuer is just two static files
How we brought on-prem Kubernetes clusters into an AKS-based GitOps platform without rebuilding a control plane every time we created one. One platform, two kinds of hardware Our developer platform runs on managed Kubernetes in the cloud, on AKS, and it is driven by GitOps. A team describes a service in a registry entry, Argo CD picks it up, and the service appears in the right namespace on the right cluster. Nobody files a ticket, and nobody runs kubectl by hand. Not everything belongs in the cloud, though. Some workloads need to sit close to machines on the shop floor, some data is not allowed to leave the building, and some things are simply cheaper on hardware we have already paid for. So we also run Kubernetes clusters in our own data centre, on vSphere. Early on we decided those clusters would not be a second platform with its own rules. They join the existing one. That word "join" carries most of the design. What we are after is roaming: a service should be...