docs: document Docker gomplate configuration

Signed-off-by: Akash Kumar <meakash7902@gmail.com>

Author: AkashKumar7902

README.md

@@ -54,6 +54,14 @@ Dex runs natively on top of any Kubernetes cluster using Custom Resource Definit
 * More docs for running dex as a Kubernetes authenticator can be found [here](https://dexidp.io/docs/guides/kubernetes/).
 * You can find more about companies and projects which use dex, [here](./ADOPTERS.md).
 
+## Docker Configuration Templates
+
+The official dex container image starts with `/usr/local/bin/docker-entrypoint`. When the entrypoint runs `dex serve`, it renders any config argument ending in `.yaml`, `.tpl`, or `.tmpl` with [gomplate](https://docs.gomplate.ca/) before starting dex. The default [`config.docker.yaml`](config.docker.yaml) file uses this behavior and shows gomplate helpers such as `{{ getenv "DEX_ISSUER" "http://127.0.0.1:5556/dex" }}` for environment-driven defaults.
+
+This gomplate preprocessing is separate from dex's own config environment expansion. Dex expands `$VAR` values in selected config sections by default, which is useful for Kubernetes ConfigMaps and Secrets. Set `DEX_EXPAND_ENV=false` if literal dollar signs should be preserved.
+
+Kubernetes manifests that override the container `command` to run `/usr/local/bin/dex` directly skip the Docker entrypoint and therefore skip gomplate. Use dex's `$VAR` expansion in that case, or keep the image entrypoint and provide `args: ["dex", "serve", "/path/to/config.yaml"]` when you want gomplate preprocessing.
+
 ## Connectors
 
 When a user logs in through dex, the user's identity is usually stored in another user-management system: a LDAP directory, a GitHub org, etc. Dex acts as a shim between a client app and the upstream identity provider. The client only needs to understand OpenID Connect to query dex, while dex implements an array of protocols for querying other user-management systems.

examples/k8s/dex.yaml

@@ -25,6 +25,9 @@ spec:
       containers:
       - image: ghcr.io/dexidp/dex:v2.32.0
         name: dex
+        # This example runs the dex binary directly, so the Docker entrypoint's
+        # gomplate preprocessing is skipped. The $GITHUB_* values below are
+        # expanded by dex's built-in config environment expansion.
         command: ["/usr/local/bin/dex", "serve", "/etc/dex/cfg/config.yaml"]
 
         ports: