feat(kubernetes): expose tenant apiserver authentication (OIDC / authentication-config / extraArgs) in app values #3074

Problem

The managed Kubernetes application (Kamaji-backed tenant control planes) exposes no way to configure the tenant kube-apiserver authentication through the application values. There is no knob for OIDC, the structured AuthenticationConfiguration, apiServer.extraArgs, or extra volumes/mounts.

This blocks two common needs:

1. OIDC SSO against a tenant cluster, so users can authenticate kubectl (or a dashboard) against an external IdP.
2. Running aggregated/extension apiservers inside the tenant cluster that require a non-empty user UID. Mapping a UID claim is only possible via the structured AuthenticationConfiguration (claimMappings.uid.claim), which requires --authentication-config (a mounted file) plus --requestheader-uid-headers on the apiserver. The legacy --oidc-* flags cannot map a UID.

Current workaround

Patch the underlying KamajiControlPlane directly:

• spec.apiServer.extraArgs: --authentication-config=..., --requestheader-uid-headers=X-Remote-Uid
• spec.apiServer.extraVolumeMounts + spec.deployment.extraVolumes: mount a ConfigMap holding the AuthenticationConfiguration

This works and survives reconcile — the chart only sets spec.apiServer.resources, so a merge-patch of these fields is not reverted. But it is out-of-band from the application values: invisible in GitOps and lost if the cluster is recreated from values.

Proposal

Pass tenant apiserver authentication settings from the Kubernetes app values through to the KamajiControlPlane — for example an apiServer.extraArgs / apiServer.extraVolumes / apiServer.extraVolumeMounts passthrough, or a dedicated oidc / authentication block that renders the structured AuthenticationConfiguration. This would let tenant clusters be configured declaratively for OIDC SSO and for extension apiservers that need a user UID.

Environment

• Cozystack 1.5.x, tenant Kubernetes application (Kamaji control plane), tenant Kubernetes v1.35.