From 171f3ed9069bc27e74415a8860629f739060383d Mon Sep 17 00:00:00 2001
From: Ryan Richard <richardry@vmware.com>
Date: Fri, 9 Oct 2020 16:28:34 -0700
Subject: [PATCH] Add some docs for how to configure the Supervisor app after
 installing

---
 deploy/supervisor/README.md | 71 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 70 insertions(+), 1 deletion(-)

diff --git a/deploy/supervisor/README.md b/deploy/supervisor/README.md
index 7920b6cb..87db1b9c 100644
--- a/deploy/supervisor/README.md
+++ b/deploy/supervisor/README.md
@@ -38,4 +38,73 @@ Either [install `ytt`](https://get-ytt.io/) or use the [container image from Doc
 
 ## Configuring After Installing
 
-TODO: Provide some instructions here.
+### Exposing the Supervisor App as a Service
+
+Create a Service to make the app available outside of the cluster. If you installed using `ytt` then you can use
+the related `service_*_port` options from [deploy/supervisor/values.yml](values.yaml) to create a Service, instead
+of creating them manually as shown below.
+
+#### Using a LoadBalancer Service
+
+Using a LoadBalancer Service is probably the easiest way to expose the Supervisor app, if your cluster supports
+LoadBalancer Services. For example:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: pinniped-supervisor-loadbalancer
+  namespace: pinniped-supervisor
+  labels:
+    app: pinniped-supervisor
+spec:
+  type: LoadBalancer
+  selector:
+    app: pinniped-supervisor
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+```
+
+#### Using a NodePort Service
+
+A NodePort Service exposes the app as a port on the nodes of the cluster.
+This is convenient for use with kind clusters, because kind can
+[expose node ports as localhost ports on the host machine](https://kind.sigs.k8s.io/docs/user/configuration/#extra-port-mappings).
+
+For example:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: pinniped-supervisor-nodeport
+  namespace: pinniped-supervisor
+  labels:
+    app: pinniped-supervisor
+spec:
+  type: NodePort
+  selector:
+    app: pinniped-supervisor
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+    nodePort: 31234
+```
+
+### Configuring the Supervisor to Act as an OIDC Provider
+
+The Supervisor can be configured as an OIDC provider by creating `OIDCProviderConfig` resources
+in the same namespace where the Supervisor app was installed. For example:
+
+```yaml
+apiVersion: config.pinniped.dev/v1alpha1
+kind: OIDCProviderConfig
+metadata:
+  name: my-provider
+  namespace: pinniped-supervisor
+spec:
+  issuer: https://my-issuer.eaxmple.com
+```