title: What is the purpose of the --oidc-client-id parameter when setting Kubernetes up to use OpenID Connect?
body: <p>The <a href="https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens" rel="nofollow noreferrer">Kubernetes documentation related to OpenID Connect</a> mentions that as part of setting things up you need to supply some parameters to the API server:</p>
  
  <pre><code>--oidc-client-id: A client id that all tokens must be issued for.
  </code></pre>
  
  <p>There is no other explanation about how this would map to, say, <a href="https://developers.google.com/identity/sign-in/web/" rel="nofollow noreferrer">something returned by the OpenID Connect-conformant Google identity provider</a>.</p>
  
  <p>I don't know what this parameter value will be used for.  Will it match against something in the decoded JWT token?</p>
  
  <p>It looks like the <code>id_token</code> returned by the Google identity provider might contain something, once decoded, in its <code>aud</code> field (<code>aud</code> is apparently short for "audience").  Is this what the <code>--oidc-client-id</code> should match?  Am I way off?</p>