×
Description

Authentication specifies cluster-wide settings for authentication (like OAuth and webhook token authenticators). The canonical name of an instance is cluster. Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).

Type

object

Required
  • spec

Specification

Property Type Description

apiVersion

string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind

string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata

ObjectMeta

Standard object’s metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

spec

object

spec holds user settable values for configuration

status

object

status holds observed values from the cluster. They may not be overridden.

.spec

Description

spec holds user settable values for configuration

Type

object

Property Type Description

oauthMetadata

object

oauthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for an external OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 If oauthMetadata.name is non-empty, this value has precedence over any metadata reference stored in status. The key "oauthMetadata" is used to locate the data. If specified and the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config.

oidcProviders

array

OIDCProviders are OIDC identity providers that can issue tokens for this cluster Can only be set if "Type" is set to "OIDC". At most one provider can be configured.

oidcProviders[]

object

serviceAccountIssuer

string

serviceAccountIssuer is the identifier of the bound service account token issuer. The default is https://kubernetes.default.svc WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the previous issuer value. Instead, the tokens issued by previous service account issuer will continue to be trusted for a time period chosen by the platform (currently set to 24h). This time period is subject to change over time. This allows internal components to transition to use new service account issuer without service distruption.

type

string

type identifies the cluster managed, user facing authentication mode in use. Specifically, it manages the component that responds to login attempts. The default is IntegratedOAuth.

webhookTokenAuthenticator

object

webhookTokenAuthenticator configures a remote token reviewer. These remote authentication webhooks can be used to verify bearer tokens via the tokenreviews.authentication.k8s.io REST API. This is required to honor bearer tokens that are provisioned by an external authentication service. Can only be set if "Type" is set to "None".

webhookTokenAuthenticators

array

webhookTokenAuthenticators is DEPRECATED, setting it has no effect.

webhookTokenAuthenticators[]

object

deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator. It’s the same as WebhookTokenAuthenticator but it’s missing the 'required' validation on KubeConfig field.

.spec.oauthMetadata

Description

oauthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for an external OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 If oauthMetadata.name is non-empty, this value has precedence over any metadata reference stored in status. The key "oauthMetadata" is used to locate the data. If specified and the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config.

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced config map

.spec.oidcProviders

Description

OIDCProviders are OIDC identity providers that can issue tokens for this cluster Can only be set if "Type" is set to "OIDC". At most one provider can be configured.

Type

array

.spec.oidcProviders[]

Description
Type

object

Required
  • issuer

  • name

Property Type Description

claimMappings

object

ClaimMappings describes rules on how to transform information from an ID token into a cluster identity

claimValidationRules

array

ClaimValidationRules are rules that are applied to validate token claims to authenticate users.

claimValidationRules[]

object

issuer

object

Issuer describes atributes of the OIDC token issuer

name

string

Name of the OIDC provider

oidcClients

array

OIDCClients contains configuration for the platform’s clients that need to request tokens from the issuer

oidcClients[]

object

.spec.oidcProviders[].claimMappings

Description

ClaimMappings describes rules on how to transform information from an ID token into a cluster identity

Type

object

Property Type Description

groups

object

Groups is a name of the claim that should be used to construct groups for the cluster identity. The referenced claim must use array of strings values.

username

object

Username is a name of the claim that should be used to construct usernames for the cluster identity. Default value: "sub"

.spec.oidcProviders[].claimMappings.groups

Description

Groups is a name of the claim that should be used to construct groups for the cluster identity. The referenced claim must use array of strings values.

Type

object

Required
  • claim

Property Type Description

claim

string

Claim is a JWT token claim to be used in the mapping

prefix

string

Prefix is a string to prefix the value from the token in the result of the claim mapping. By default, no prefixing occurs. Example: if prefix is set to "myoidc:"" and the claim in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".

.spec.oidcProviders[].claimMappings.username

Description

Username is a name of the claim that should be used to construct usernames for the cluster identity. Default value: "sub"

Type

object

Required
  • claim

Property Type Description

claim

string

Claim is a JWT token claim to be used in the mapping

prefix

object

prefixPolicy

string

PrefixPolicy specifies how a prefix should apply. By default, claims other than email will be prefixed with the issuer URL to prevent naming clashes with other plugins. Set to "NoPrefix" to disable prefixing. Example: (1) prefix is set to "myoidc:" and claim is set to "username". If the JWT claim username contains value userA, the resulting mapped value will be "myoidc:userA". (2) prefix is set to "myoidc:" and claim is set to "email". If the JWT email claim contains value "userA@myoidc.tld", the resulting mapped value will be "myoidc:userA@myoidc.tld". (3) prefix is unset, issuerURL is set to https://myoidc.tld, the JWT claims include "username":"userA" and "email":"userA@myoidc.tld", and claim is set to: (a) "username": the mapped value will be "https://myoidc.tld#userA" (b) "email": the mapped value will be "userA@myoidc.tld"

.spec.oidcProviders[].claimMappings.username.prefix

Description
Type

object

Required
  • prefixString

Property Type Description

prefixString

string

.spec.oidcProviders[].claimValidationRules

Description

ClaimValidationRules are rules that are applied to validate token claims to authenticate users.

Type

array

.spec.oidcProviders[].claimValidationRules[]

Description
Type

object

Property Type Description

requiredClaim

object

RequiredClaim allows configuring a required claim name and its expected value

type

string

Type sets the type of the validation rule

.spec.oidcProviders[].claimValidationRules[].requiredClaim

Description

RequiredClaim allows configuring a required claim name and its expected value

Type

object

Required
  • claim

  • requiredValue

Property Type Description

claim

string

Claim is a name of a required claim. Only claims with string values are supported.

requiredValue

string

RequiredValue is the required value for the claim.

.spec.oidcProviders[].issuer

Description

Issuer describes atributes of the OIDC token issuer

Type

object

Required
  • audiences

  • issuerURL

Property Type Description

audiences

array (string)

Audiences is an array of audiences that the token was issued for. Valid tokens must include at least one of these values in their "aud" claim. Must be set to exactly one value.

issuerCertificateAuthority

object

CertificateAuthority is a reference to a config map in the configuration namespace. The .data of the configMap must contain the "ca-bundle.crt" key. If unset, system trust is used instead.

issuerURL

string

URL is the serving URL of the token issuer. Must use the https:// scheme.

.spec.oidcProviders[].issuer.issuerCertificateAuthority

Description

CertificateAuthority is a reference to a config map in the configuration namespace. The .data of the configMap must contain the "ca-bundle.crt" key. If unset, system trust is used instead.

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced config map

.spec.oidcProviders[].oidcClients

Description

OIDCClients contains configuration for the platform’s clients that need to request tokens from the issuer

Type

array

.spec.oidcProviders[].oidcClients[]

Description
Type

object

Required
  • clientID

  • componentName

  • componentNamespace

Property Type Description

clientID

string

ClientID is the identifier of the OIDC client from the OIDC provider

clientSecret

object

ClientSecret refers to a secret in the openshift-config namespace that contains the client secret in the clientSecret key of the .data field

componentName

string

ComponentName is the name of the component that is supposed to consume this client configuration

componentNamespace

string

ComponentNamespace is the namespace of the component that is supposed to consume this client configuration

extraScopes

array (string)

ExtraScopes is an optional set of scopes to request tokens with.

.spec.oidcProviders[].oidcClients[].clientSecret

Description

ClientSecret refers to a secret in the openshift-config namespace that contains the client secret in the clientSecret key of the .data field

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced secret

.spec.webhookTokenAuthenticator

Description

webhookTokenAuthenticator configures a remote token reviewer. These remote authentication webhooks can be used to verify bearer tokens via the tokenreviews.authentication.k8s.io REST API. This is required to honor bearer tokens that are provisioned by an external authentication service. Can only be set if "Type" is set to "None".

Type

object

Required
  • kubeConfig

Property Type Description

kubeConfig

object

kubeConfig references a secret that contains kube config file data which describes how to access the remote webhook service. The namespace for the referenced secret is openshift-config. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored.

.spec.webhookTokenAuthenticator.kubeConfig

Description

kubeConfig references a secret that contains kube config file data which describes how to access the remote webhook service. The namespace for the referenced secret is openshift-config. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored.

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced secret

.spec.webhookTokenAuthenticators

Description

webhookTokenAuthenticators is DEPRECATED, setting it has no effect.

Type

array

.spec.webhookTokenAuthenticators[]

Description

deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator. It’s the same as WebhookTokenAuthenticator but it’s missing the 'required' validation on KubeConfig field.

Type

object

Property Type Description

kubeConfig

object

kubeConfig contains kube config file data which describes how to access the remote webhook service. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored. The namespace for this secret is determined by the point of use.

.spec.webhookTokenAuthenticators[].kubeConfig

Description

kubeConfig contains kube config file data which describes how to access the remote webhook service. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored. The namespace for this secret is determined by the point of use.

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced secret

.status

Description

status holds observed values from the cluster. They may not be overridden.

Type

object

Property Type Description

integratedOAuthMetadata

object

integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for the in-cluster integrated OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 This contains the observed value based on cluster state. An explicitly set value in spec.oauthMetadata has precedence over this field. This field has no meaning if authentication spec.type is not set to IntegratedOAuth. The key "oauthMetadata" is used to locate the data. If the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config-managed.

oidcClients

array

OIDCClients is where participating operators place the current OIDC client status for OIDC clients that can be customized by the cluster-admin.

oidcClients[]

object

.status.integratedOAuthMetadata

Description

integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for the in-cluster integrated OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 This contains the observed value based on cluster state. An explicitly set value in spec.oauthMetadata has precedence over this field. This field has no meaning if authentication spec.type is not set to IntegratedOAuth. The key "oauthMetadata" is used to locate the data. If the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config-managed.

Type

object

Required
  • name

Property Type Description

name

string

name is the metadata.name of the referenced config map

.status.oidcClients

Description

OIDCClients is where participating operators place the current OIDC client status for OIDC clients that can be customized by the cluster-admin.

Type

array

.status.oidcClients[]

Description
Type

object

Required
  • componentName

  • componentNamespace

Property Type Description

componentName

string

ComponentName is the name of the component that will consume a client configuration.

componentNamespace

string

ComponentNamespace is the namespace of the component that will consume a client configuration.

conditions

array

Conditions are used to communicate the state of the oidcClients entry. Supported conditions include Available, Degraded and Progressing. If Available is true, the component is successfully using the configured client. If Degraded is true, that means something has gone wrong trying to handle the client configuration. If Progressing is true, that means the component is taking some action related to the oidcClients entry.

conditions[]

object

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo’s current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

consumingUsers

array (string)

ConsumingUsers is a slice of ServiceAccounts that need to have read permission on the clientSecret secret.

currentOIDCClients

array

CurrentOIDCClients is a list of clients that the component is currently using.

currentOIDCClients[]

object

.status.oidcClients[].conditions

Description

Conditions are used to communicate the state of the oidcClients entry. Supported conditions include Available, Degraded and Progressing. If Available is true, the component is successfully using the configured client. If Degraded is true, that means something has gone wrong trying to handle the client configuration. If Progressing is true, that means the component is taking some action related to the oidcClients entry.

Type

array

.status.oidcClients[].conditions[]

Description

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo’s current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

Type

object

Required
  • lastTransitionTime

  • message

  • reason

  • status

  • type

Property Type Description

lastTransitionTime

string

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

message

string

message is a human readable message indicating details about the transition. This may be an empty string.

observedGeneration

integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

reason

string

reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

status

string

status of the condition, one of True, False, Unknown.

type

string

type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)

.status.oidcClients[].currentOIDCClients

Description

CurrentOIDCClients is a list of clients that the component is currently using.

Type

array

.status.oidcClients[].currentOIDCClients[]

Description
Type

object

Required
  • clientID

  • issuerURL

  • oidcProviderName

Property Type Description

clientID

string

ClientID is the identifier of the OIDC client from the OIDC provider

issuerURL

string

URL is the serving URL of the token issuer. Must use the https:// scheme.

oidcProviderName

string

OIDCName refers to the name of the provider from oidcProviders

API endpoints

The following API endpoints are available:

  • /apis/config.openshift.io/v1/authentications

    • DELETE: delete collection of Authentication

    • GET: list objects of kind Authentication

    • POST: create an Authentication

  • /apis/config.openshift.io/v1/authentications/{name}

    • DELETE: delete an Authentication

    • GET: read the specified Authentication

    • PATCH: partially update the specified Authentication

    • PUT: replace the specified Authentication

  • /apis/config.openshift.io/v1/authentications/{name}/status

    • GET: read status of the specified Authentication

    • PATCH: partially update status of the specified Authentication

    • PUT: replace status of the specified Authentication

/apis/config.openshift.io/v1/authentications

HTTP method

DELETE

Description

delete collection of Authentication

Table 1. HTTP responses
HTTP code Reponse body

200 - OK

Status schema

401 - Unauthorized

Empty

HTTP method

GET

Description

list objects of kind Authentication

Table 2. HTTP responses
HTTP code Reponse body

200 - OK

AuthenticationList schema

401 - Unauthorized

Empty

HTTP method

POST

Description

create an Authentication

Table 3. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

Table 4. Body parameters
Parameter Type Description

body

Authentication schema

Table 5. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

201 - Created

Authentication schema

202 - Accepted

Authentication schema

401 - Unauthorized

Empty

/apis/config.openshift.io/v1/authentications/{name}

Table 6. Global path parameters
Parameter Type Description

name

string

name of the Authentication

HTTP method

DELETE

Description

delete an Authentication

Table 7. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

Table 8. HTTP responses
HTTP code Reponse body

200 - OK

Status schema

202 - Accepted

Status schema

401 - Unauthorized

Empty

HTTP method

GET

Description

read the specified Authentication

Table 9. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

401 - Unauthorized

Empty

HTTP method

PATCH

Description

partially update the specified Authentication

Table 10. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

Table 11. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

401 - Unauthorized

Empty

HTTP method

PUT

Description

replace the specified Authentication

Table 12. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

Table 13. Body parameters
Parameter Type Description

body

Authentication schema

Table 14. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

201 - Created

Authentication schema

401 - Unauthorized

Empty

/apis/config.openshift.io/v1/authentications/{name}/status

Table 15. Global path parameters
Parameter Type Description

name

string

name of the Authentication

HTTP method

GET

Description

read status of the specified Authentication

Table 16. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

401 - Unauthorized

Empty

HTTP method

PATCH

Description

partially update status of the specified Authentication

Table 17. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

Table 18. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

401 - Unauthorized

Empty

HTTP method

PUT

Description

replace status of the specified Authentication

Table 19. Query parameters
Parameter Type Description

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

Table 20. Body parameters
Parameter Type Description

body

Authentication schema

Table 21. HTTP responses
HTTP code Reponse body

200 - OK

Authentication schema

201 - Created

Authentication schema

401 - Unauthorized

Empty