mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-01-07 14:05:50 +00:00
346 lines
18 KiB
YAML
Generated
346 lines
18 KiB
YAML
Generated
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.18.0
|
|
name: jwtauthenticators.authentication.concierge.pinniped.dev
|
|
spec:
|
|
group: authentication.concierge.pinniped.dev
|
|
names:
|
|
categories:
|
|
- pinniped
|
|
- pinniped-authenticator
|
|
- pinniped-authenticators
|
|
kind: JWTAuthenticator
|
|
listKind: JWTAuthenticatorList
|
|
plural: jwtauthenticators
|
|
singular: jwtauthenticator
|
|
scope: Cluster
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- jsonPath: .spec.issuer
|
|
name: Issuer
|
|
type: string
|
|
- jsonPath: .spec.audience
|
|
name: Audience
|
|
type: string
|
|
- jsonPath: .status.phase
|
|
name: Status
|
|
type: string
|
|
- jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: |-
|
|
JWTAuthenticator describes the configuration of a JWT authenticator.
|
|
|
|
Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
|
|
signature, existence of claims, etc.) and extract the username and groups from the token.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: spec for configuring the authenticator.
|
|
properties:
|
|
audience:
|
|
description: audience is the required value of the "aud" JWT claim.
|
|
minLength: 1
|
|
type: string
|
|
claimValidationRules:
|
|
description: |-
|
|
claimValidationRules are rules that are applied to validate token claims to authenticate users.
|
|
This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
|
|
https://kubernetes.io/docs/reference/access-authn-authz/authentication.
|
|
This is an advanced configuration option. During an end-user login flow, mistakes in this
|
|
configuration will cause the user's login to fail.
|
|
items:
|
|
description: ClaimValidationRule provides the configuration for
|
|
a single claim validation rule.
|
|
properties:
|
|
claim:
|
|
description: |-
|
|
claim is the name of a required claim.
|
|
Same as --oidc-required-claim flag.
|
|
Only string claim keys are supported.
|
|
Mutually exclusive with expression and message.
|
|
type: string
|
|
expression:
|
|
description: |-
|
|
expression represents the expression which will be evaluated by CEL.
|
|
Must produce a boolean.
|
|
|
|
CEL expressions have access to the contents of the token claims, organized into CEL variable:
|
|
- 'claims' is a map of claim names to claim values.
|
|
For example, a variable named 'sub' can be accessed as 'claims.sub'.
|
|
Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
|
|
Must return true for the validation to pass.
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
|
|
Mutually exclusive with claim and requiredValue.
|
|
type: string
|
|
message:
|
|
description: |-
|
|
message customizes the returned error message when expression returns false.
|
|
message is a literal string.
|
|
Mutually exclusive with claim and requiredValue.
|
|
type: string
|
|
requiredValue:
|
|
description: |-
|
|
requiredValue is the value of a required claim.
|
|
Same as --oidc-required-claim flag.
|
|
Only string claim values are supported.
|
|
If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string.
|
|
Mutually exclusive with expression and message.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
claims:
|
|
description: |-
|
|
claims allows customization of the claims that will be mapped to user identity
|
|
for Kubernetes access.
|
|
properties:
|
|
extra:
|
|
description: |-
|
|
extra is similar to claimMappings.extra from Kubernetes AuthenticationConfiguration as documented in
|
|
https://kubernetes.io/docs/reference/access-authn-authz/authentication. However, note that the
|
|
Pinniped Concierge issues client certificates to users for the purpose of authenticating, and
|
|
the Kubernetes API server does not have any mechanism for transmitting auth extras via client
|
|
certificates. When configured, these extras will appear in client certificates issued by the
|
|
Pinniped Supervisor in the x509 Subject field as Organizational Units (OU). However, when this
|
|
client certificate is presented to Kubernetes for authentication, Kubernetes will ignore these
|
|
extras. This is probably only useful if you are using a custom authenticating proxy in front
|
|
of your Kubernetes API server which can translate these OUs into auth extras, as described by
|
|
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy.
|
|
This is an advanced configuration option. During an end-user login flow, each of these CEL expressions
|
|
must evaluate to either a string or an array of strings, or else the user's login will fail.
|
|
items:
|
|
description: ExtraMapping provides the configuration for a single
|
|
extra mapping.
|
|
properties:
|
|
key:
|
|
description: |-
|
|
key is a string to use as the extra attribute key.
|
|
key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid
|
|
subdomain as defined by RFC 1123. All characters trailing the first "/" must
|
|
be valid HTTP Path characters as defined by RFC 3986.
|
|
key must be lowercase.
|
|
Required to be unique.
|
|
type: string
|
|
valueExpression:
|
|
description: |-
|
|
valueExpression is a CEL expression to extract extra attribute value.
|
|
valueExpression must produce a string or string array value.
|
|
"", [], and null values are treated as the extra mapping not being present.
|
|
Empty string values contained within a string array are filtered out.
|
|
|
|
CEL expressions have access to the contents of the token claims, organized into CEL variable:
|
|
- 'claims' is a map of claim names to claim values.
|
|
For example, a variable named 'sub' can be accessed as 'claims.sub'.
|
|
Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
type: string
|
|
required:
|
|
- key
|
|
- valueExpression
|
|
type: object
|
|
type: array
|
|
groups:
|
|
description: |-
|
|
groups is the name of the claim which should be read to extract the user's
|
|
group membership from the JWT token. When not specified, it will default to "groups".
|
|
type: string
|
|
username:
|
|
description: |-
|
|
username is the name of the claim which should be read to extract the
|
|
username from the JWT token. When not specified, it will default to "username".
|
|
type: string
|
|
type: object
|
|
issuer:
|
|
description: |-
|
|
issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is
|
|
also used to validate the "iss" JWT claim.
|
|
minLength: 1
|
|
pattern: ^https://
|
|
type: string
|
|
tls:
|
|
description: tls is the configuration for communicating with the OIDC
|
|
provider via TLS.
|
|
properties:
|
|
certificateAuthorityData:
|
|
description: X.509 Certificate Authority (base64-encoded PEM bundle).
|
|
If omitted, a default set of system roots will be trusted.
|
|
type: string
|
|
certificateAuthorityDataSource:
|
|
description: |-
|
|
Reference to a CA bundle in a secret or a configmap.
|
|
Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
|
|
properties:
|
|
key:
|
|
description: |-
|
|
Key is the key name within the secret or configmap from which to read the CA bundle.
|
|
The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
|
|
certificate bundle.
|
|
minLength: 1
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
|
|
Allowed values are "Secret" or "ConfigMap".
|
|
"ConfigMap" uses a Kubernetes configmap to source CA Bundles.
|
|
"Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
|
|
enum:
|
|
- Secret
|
|
- ConfigMap
|
|
type: string
|
|
name:
|
|
description: |-
|
|
Name is the resource name of the secret or configmap from which to read the CA bundle.
|
|
The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed.
|
|
minLength: 1
|
|
type: string
|
|
required:
|
|
- key
|
|
- kind
|
|
- name
|
|
type: object
|
|
type: object
|
|
userValidationRules:
|
|
description: |-
|
|
userValidationRules are rules that are applied to final user before completing authentication.
|
|
These allow invariants to be applied to incoming identities such as preventing the
|
|
use of the system: prefix that is commonly used by Kubernetes components.
|
|
The validation rules are logically ANDed together and must all return true for the validation to pass.
|
|
This is similar to claimValidationRules from Kubernetes AuthenticationConfiguration as documented in
|
|
https://kubernetes.io/docs/reference/access-authn-authz/authentication.
|
|
This is an advanced configuration option. During an end-user login flow, mistakes in this
|
|
configuration will cause the user's login to fail.
|
|
items:
|
|
description: UserValidationRule provides the configuration for a
|
|
single user info validation rule.
|
|
properties:
|
|
expression:
|
|
description: |-
|
|
expression represents the expression which will be evaluated by CEL.
|
|
Must return true for the validation to pass.
|
|
|
|
CEL expressions have access to the contents of UserInfo, organized into CEL variable:
|
|
- 'user' - authentication.k8s.io/v1, Kind=UserInfo object
|
|
Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
|
|
API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
type: string
|
|
message:
|
|
description: |-
|
|
message customizes the returned error message when rule returns false.
|
|
message is a literal string.
|
|
type: string
|
|
required:
|
|
- expression
|
|
type: object
|
|
type: array
|
|
required:
|
|
- audience
|
|
- issuer
|
|
type: object
|
|
status:
|
|
description: status of the authenticator.
|
|
properties:
|
|
conditions:
|
|
description: Represents the observations of the authenticator's current
|
|
state.
|
|
items:
|
|
description: Condition contains details for one aspect of the current
|
|
state of this API Resource.
|
|
properties:
|
|
lastTransitionTime:
|
|
description: |-
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: |-
|
|
message is a human readable message indicating details about the transition.
|
|
This may be an empty string.
|
|
maxLength: 32768
|
|
type: string
|
|
observedGeneration:
|
|
description: |-
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
with respect to the current state of the instance.
|
|
format: int64
|
|
minimum: 0
|
|
type: integer
|
|
reason:
|
|
description: |-
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
and whether the values are considered a guaranteed API.
|
|
The value should be a CamelCase string.
|
|
This field may not be empty.
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
type: string
|
|
status:
|
|
description: status of the condition, one of True, False, Unknown.
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type: string
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
x-kubernetes-list-map-keys:
|
|
- type
|
|
x-kubernetes-list-type: map
|
|
phase:
|
|
default: Pending
|
|
description: Phase summarizes the overall status of the JWTAuthenticator.
|
|
enum:
|
|
- Pending
|
|
- Ready
|
|
- Error
|
|
type: string
|
|
type: object
|
|
required:
|
|
- spec
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|