Merge pull request #16401 from jamieklassen/gitlab-oidc-k8s

GitLab auth provider gets ID tokens and be used as a k8s oidcTokenProvider

docs/auth/gitlab/provider.md

@@ -18,7 +18,11 @@ Settings for local development:
 
 - Name: Backstage (or your custom app name)
 - Redirect URI: `http://localhost:7007/api/auth/gitlab/handler/frame`
-- Scopes: `read_api` and `read_user`
+- Scopes: `read_user` for sign-in. If you also need ID tokens (e.g. if you are
+  using the Kubernetes plugin and have clusters with `authProvider: oidc` and
+  [`oidcTokenProvider:
+gitlab`](https://backstage.io/docs/features/kubernetes/configuration/#clustersoidctokenprovider-optional)),
+  add the `openid` scope.
 
 ## Configuration
 

docs/features/kubernetes/configuration.md

@@ -160,8 +160,9 @@ auth:
         audience: ${AUTH_OKTA_AUDIENCE}
 ```
 
-The following values are supported out-of-the-box by the frontend: `google`, `microsoft`,
-`okta`, `onelogin`.
+The following values are supported out-of-the-box by the frontend: `gitlab` (the
+application whose `clientId` is used by the auth provider should be granted the
+`openid` scope), `google`, `microsoft`, `okta`, `onelogin`.
 
 Take note that `oidcTokenProvider` is just the issuer for the token, you can use any
 of these with an OIDC enabled cluster, like using `microsoft` as the issuer for a EKS