Authentication [config.openshift.io/v1]

oauthMetadata

object

oauthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for an external OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 If oauthMetadata.name is non-empty, this value has precedence over any metadata reference stored in status. The key "oauthMetadata" is used to locate the data. If specified and the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config.

oidcProviders

array

OIDCProviders are OIDC identity providers that can issue tokens for this cluster Can only be set if "Type" is set to "OIDC". At most one provider can be configured.

oidcProviders[]

object

serviceAccountIssuer

string

serviceAccountIssuer is the identifier of the bound service account token issuer. The default is https://kubernetes.default.svc WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the previous issuer value. Instead, the tokens issued by previous service account issuer will continue to be trusted for a time period chosen by the platform (currently set to 24h). This time period is subject to change over time. This allows internal components to transition to use new service account issuer without service distruption.

type

string

type identifies the cluster managed, user facing authentication mode in use. Specifically, it manages the component that responds to login attempts. The default is IntegratedOAuth.

webhookTokenAuthenticator

object

webhookTokenAuthenticator configures a remote token reviewer. These remote authentication webhooks can be used to verify bearer tokens via the tokenreviews.authentication.k8s.io REST API. This is required to honor bearer tokens that are provisioned by an external authentication service. Can only be set if "Type" is set to "None".

webhookTokenAuthenticators

array

webhookTokenAuthenticators is DEPRECATED, setting it has no effect.

webhookTokenAuthenticators[]

object

deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator. It’s the same as WebhookTokenAuthenticator but it’s missing the 'required' validation on KubeConfig field.

name

string

name is the metadata.name of the referenced config map

claimMappings

object

ClaimMappings describes rules on how to transform information from an ID token into a cluster identity

claimValidationRules

array

ClaimValidationRules are rules that are applied to validate token claims to authenticate users.

claimValidationRules[]

object

issuer

object

Issuer describes atributes of the OIDC token issuer

name

string

Name of the OIDC provider

oidcClients

array

OIDCClients contains configuration for the platform’s clients that need to request tokens from the issuer

oidcClients[]

object

groups

object

Groups is a name of the claim that should be used to construct groups for the cluster identity. The referenced claim must use array of strings values.

username

object

Username is a name of the claim that should be used to construct usernames for the cluster identity. Default value: "sub"

claim

string

Claim is a JWT token claim to be used in the mapping

prefix

string

Prefix is a string to prefix the value from the token in the result of the claim mapping. By default, no prefixing occurs. Example: if prefix is set to "myoidc:"" and the claim in JWT contains an array of strings "a", "b" and "c", the mapping will result in an array of string "myoidc:a", "myoidc:b" and "myoidc:c".

claim

string

Claim is a JWT token claim to be used in the mapping

prefix

object

prefixPolicy

string

PrefixPolicy specifies how a prefix should apply. By default, claims other than email will be prefixed with the issuer URL to prevent naming clashes with other plugins. Set to "NoPrefix" to disable prefixing. Example: (1) prefix is set to "myoidc:" and claim is set to "username". If the JWT claim username contains value userA, the resulting mapped value will be "myoidc:userA". (2) prefix is set to "myoidc:" and claim is set to "email". If the JWT email claim contains value "userA@myoidc.tld", the resulting mapped value will be "myoidc:userA@myoidc.tld". (3) prefix is unset, issuerURL is set to https://myoidc.tld, the JWT claims include "username":"userA" and "email":"userA@myoidc.tld", and claim is set to: (a) "username": the mapped value will be "https://myoidc.tld#userA" (b) "email": the mapped value will be "userA@myoidc.tld"

prefixString

string

requiredClaim

object

RequiredClaim allows configuring a required claim name and its expected value

type

string

Type sets the type of the validation rule

claim

string

Claim is a name of a required claim. Only claims with string values are supported.

requiredValue

string

RequiredValue is the required value for the claim.

audiences

array (string)

Audiences is an array of audiences that the token was issued for. Valid tokens must include at least one of these values in their "aud" claim. Must be set to exactly one value.

issuerCertificateAuthority

object

CertificateAuthority is a reference to a config map in the configuration namespace. The .data of the configMap must contain the "ca-bundle.crt" key. If unset, system trust is used instead.

issuerURL

string

URL is the serving URL of the token issuer. Must use the https:// scheme.

name

string

name is the metadata.name of the referenced config map

clientID

string

ClientID is the identifier of the OIDC client from the OIDC provider

clientSecret

object

ClientSecret refers to a secret in the openshift-config namespace that contains the client secret in the clientSecret key of the .data field

componentName

string

ComponentName is the name of the component that is supposed to consume this client configuration

componentNamespace

string

ComponentNamespace is the namespace of the component that is supposed to consume this client configuration

extraScopes

array (string)

ExtraScopes is an optional set of scopes to request tokens with.

name

string

name is the metadata.name of the referenced secret

kubeConfig

object

kubeConfig references a secret that contains kube config file data which describes how to access the remote webhook service. The namespace for the referenced secret is openshift-config. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored.

name

string

name is the metadata.name of the referenced secret

kubeConfig

object

kubeConfig contains kube config file data which describes how to access the remote webhook service. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored. The namespace for this secret is determined by the point of use.

name

string

name is the metadata.name of the referenced secret

integratedOAuthMetadata

object

integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for the in-cluster integrated OAuth server. This discovery document can be viewed from its served location: oc get --raw '/.well-known/oauth-authorization-server' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 This contains the observed value based on cluster state. An explicitly set value in spec.oauthMetadata has precedence over this field. This field has no meaning if authentication spec.type is not set to IntegratedOAuth. The key "oauthMetadata" is used to locate the data. If the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config-managed.

oidcClients

array

OIDCClients is where participating operators place the current OIDC client status for OIDC clients that can be customized by the cluster-admin.

oidcClients[]

object

name

string

name is the metadata.name of the referenced config map

componentName

string

ComponentName is the name of the component that will consume a client configuration.

componentNamespace

string

ComponentNamespace is the namespace of the component that will consume a client configuration.

conditions

array

Conditions are used to communicate the state of the oidcClients entry. Supported conditions include Available, Degraded and Progressing. If Available is true, the component is successfully using the configured client. If Degraded is true, that means something has gone wrong trying to handle the client configuration. If Progressing is true, that means the component is taking some action related to the oidcClients entry.

conditions[]

object

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo’s current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

consumingUsers

array (string)

ConsumingUsers is a slice of ServiceAccounts that need to have read permission on the clientSecret secret.

currentOIDCClients

array

CurrentOIDCClients is a list of clients that the component is currently using.

currentOIDCClients[]

object

lastTransitionTime

string

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

message

string

message is a human readable message indicating details about the transition. This may be an empty string.

observedGeneration

integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

reason

string

reason contains a programmatic identifier indicating the reason for the condition’s last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

status

string

status of the condition, one of True, False, Unknown.

type

string

type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)

clientID

string

ClientID is the identifier of the OIDC client from the OIDC provider

issuerURL

string

URL is the serving URL of the token issuer. Must use the https:// scheme.

oidcProviderName

string

OIDCName refers to the name of the provider from oidcProviders

200 - OK

Status schema

401 - Unauthorized

Empty

200 - OK

AuthenticationList schema

401 - Unauthorized

Empty

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

body

Authentication schema

200 - OK

Authentication schema

201 - Created

Authentication schema

202 - Accepted

Authentication schema

401 - Unauthorized

Empty

name

string

name of the Authentication

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

200 - OK

Status schema

202 - Accepted

Status schema

401 - Unauthorized

Empty

200 - OK

Authentication schema

401 - Unauthorized

Empty

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

200 - OK

Authentication schema

401 - Unauthorized

Empty

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

body

Authentication schema

200 - OK

Authentication schema

201 - Created

Authentication schema

401 - Unauthorized

Empty

name

string

name of the Authentication

200 - OK

Authentication schema

401 - Unauthorized

Empty

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

200 - OK

Authentication schema

401 - Unauthorized

Empty

dryRun

string

When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed

fieldValidation

string

fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.

body

Authentication schema

200 - OK

Authentication schema

201 - Created

Authentication schema

401 - Unauthorized

Empty