mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2025-12-23 06:15:47 +00:00
2540 lines
124 KiB
Plaintext
Generated
2540 lines
124 KiB
Plaintext
Generated
// Generated documentation. Please do not edit.
|
|
:anchor_prefix: k8s-api
|
|
|
|
[id="{p}-api-reference"]
|
|
== API Reference
|
|
|
|
.Packages
|
|
- xref:{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1[$$authentication.concierge.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-clientsecret-supervisor-pinniped-dev-clientsecret[$$clientsecret.supervisor.pinniped.dev/clientsecret$$]
|
|
- xref:{anchor_prefix}-clientsecret-supervisor-pinniped-dev-v1alpha1[$$clientsecret.supervisor.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1[$$config.concierge.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-config-supervisor-pinniped-dev-v1alpha1[$$config.supervisor.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-identity-concierge-pinniped-dev-identity[$$identity.concierge.pinniped.dev/identity$$]
|
|
- xref:{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1[$$identity.concierge.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1[$$idp.supervisor.pinniped.dev/v1alpha1$$]
|
|
- xref:{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1[$$login.concierge.pinniped.dev/v1alpha1$$]
|
|
|
|
|
|
[id="{anchor_prefix}-authentication-concierge-pinniped-dev-v1alpha1"]
|
|
=== authentication.concierge.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped concierge authentication API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-cabundlesource"]
|
|
==== CABundleSource
|
|
|
|
CABundleSource provides a source for CA bundle used for client-side TLS verification.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-tlsspec[$$TLSSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`kind`* __string__ | Whether the CA bundle is being sourced from a kubernetes secret or a configmap. +
|
|
Secrets must be of type kubernetes.io/tls or Opaque. +
|
|
For configmaps, the value associated with the key is not expected to be base64 encoded. +
|
|
| *`name`* __string__ | Name of the secret or configmap from which to read the CA bundle. +
|
|
The referenced secret or configmap must be created in the same namespace where Pinniped Concierge is installed. +
|
|
| *`key`* __string__ | Key within the secret or configmap from which to read the CA bundle. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticator"]
|
|
==== JWTAuthenticator
|
|
|
|
JWTAuthenticator describes the configuration of a JWT authenticator.
|
|
|
|
|
|
Upon receiving a signed JWT, a JWTAuthenticator will performs some validation on it (e.g., valid
|
|
signature, existence of claims, etc.) and extract the username and groups from the token.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorlist[$$JWTAuthenticatorList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]__ | Spec for configuring the authenticator. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus[$$JWTAuthenticatorStatus$$]__ | Status of the authenticator. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorphase"]
|
|
==== JWTAuthenticatorPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus[$$JWTAuthenticatorStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec"]
|
|
==== JWTAuthenticatorSpec
|
|
|
|
Spec for configuring a JWT authenticator.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticator[$$JWTAuthenticator$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`issuer`* __string__ | Issuer is the OIDC issuer URL that will be used to discover public signing keys. Issuer is +
|
|
also used to validate the "iss" JWT claim. +
|
|
| *`audience`* __string__ | Audience is the required value of the "aud" JWT claim. +
|
|
| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwttokenclaims[$$JWTTokenClaims$$]__ | Claims allows customization of the claims that will be mapped to user identity +
|
|
for Kubernetes access. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for communicating with the OIDC provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorstatus"]
|
|
==== JWTAuthenticatorStatus
|
|
|
|
Status of a JWT authenticator.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticator[$$JWTAuthenticator$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Represents the observations of the authenticator's current state. +
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorphase[$$JWTAuthenticatorPhase$$]__ | Phase summarizes the overall status of the JWTAuthenticator. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwttokenclaims"]
|
|
==== JWTTokenClaims
|
|
|
|
JWTTokenClaims allows customization of the claims that will be mapped to user identity
|
|
for Kubernetes access.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`groups`* __string__ | Groups is the name of the claim which should be read to extract the user's +
|
|
group membership from the JWT token. When not specified, it will default to "groups". +
|
|
| *`username`* __string__ | Username is the name of the claim which should be read to extract the +
|
|
username from the JWT token. When not specified, it will default to "username". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-tlsspec"]
|
|
==== TLSSpec
|
|
|
|
Configuration for configuring TLS on various authenticators.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-jwtauthenticatorspec[$$JWTAuthenticatorSpec$$]
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec[$$WebhookAuthenticatorSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`certificateAuthorityData`* __string__ | X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted. +
|
|
| *`certificateAuthorityDataSource`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-cabundlesource[$$CABundleSource$$]__ | Reference to a CA bundle in a secret or a configmap. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticator"]
|
|
==== WebhookAuthenticator
|
|
|
|
WebhookAuthenticator describes the configuration of a webhook authenticator.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorlist[$$WebhookAuthenticatorList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec[$$WebhookAuthenticatorSpec$$]__ | Spec for configuring the authenticator. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus[$$WebhookAuthenticatorStatus$$]__ | Status of the authenticator. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorphase"]
|
|
==== WebhookAuthenticatorPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus[$$WebhookAuthenticatorStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorspec"]
|
|
==== WebhookAuthenticatorSpec
|
|
|
|
Spec for configuring a webhook authenticator.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticator[$$WebhookAuthenticator$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`endpoint`* __string__ | Webhook server endpoint URL. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorstatus"]
|
|
==== WebhookAuthenticatorStatus
|
|
|
|
Status of a webhook authenticator.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticator[$$WebhookAuthenticator$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Represents the observations of the authenticator's current state. +
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-authentication-v1alpha1-webhookauthenticatorphase[$$WebhookAuthenticatorPhase$$]__ | Phase summarizes the overall status of the WebhookAuthenticator. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-clientsecret-supervisor-pinniped-dev-clientsecret"]
|
|
=== clientsecret.supervisor.pinniped.dev/clientsecret
|
|
|
|
Package clientsecret is the internal version of the Pinniped client secret API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequest"]
|
|
==== OIDCClientSecretRequest
|
|
|
|
OIDCClientSecretRequest can be used to update the client secrets associated with an OIDCClient.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequestlist[$$OIDCClientSecretRequestList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ |
|
|
| *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequestspec[$$OIDCClientSecretRequestSpec$$]__ |
|
|
| *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequeststatus[$$OIDCClientSecretRequestStatus$$]__ |
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequestspec"]
|
|
==== OIDCClientSecretRequestSpec
|
|
|
|
Spec of the OIDCClientSecretRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequest[$$OIDCClientSecretRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`GenerateNewSecret`* __boolean__ | Request a new client secret to for the OIDCClient referenced by the metadata.name field. +
|
|
| *`RevokeOldSecrets`* __boolean__ | Revoke the old client secrets associated with the OIDCClient referenced by the metadata.name field. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequeststatus"]
|
|
==== OIDCClientSecretRequestStatus
|
|
|
|
Status of the OIDCClientSecretRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-oidcclientsecretrequest[$$OIDCClientSecretRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`GeneratedSecret`* __string__ | The unencrypted OIDC Client Secret. This will only be shared upon creation and cannot be recovered if lost. +
|
|
| *`TotalClientSecrets`* __integer__ | The total number of client secrets associated with the OIDCClient referenced by the metadata.name field. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-clientsecret-supervisor-pinniped-dev-v1alpha1"]
|
|
=== clientsecret.supervisor.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped client secret API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequest"]
|
|
==== OIDCClientSecretRequest
|
|
|
|
OIDCClientSecretRequest can be used to update the client secrets associated with an OIDCClient.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequestlist[$$OIDCClientSecretRequestList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequestspec[$$OIDCClientSecretRequestSpec$$]__ |
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequeststatus[$$OIDCClientSecretRequestStatus$$]__ |
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequestspec"]
|
|
==== OIDCClientSecretRequestSpec
|
|
|
|
Spec of the OIDCClientSecretRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequest[$$OIDCClientSecretRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`generateNewSecret`* __boolean__ | Request a new client secret to for the OIDCClient referenced by the metadata.name field. +
|
|
| *`revokeOldSecrets`* __boolean__ | Revoke the old client secrets associated with the OIDCClient referenced by the metadata.name field. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequeststatus"]
|
|
==== OIDCClientSecretRequestStatus
|
|
|
|
Status of the OIDCClientSecretRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-clientsecret-v1alpha1-oidcclientsecretrequest[$$OIDCClientSecretRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`generatedSecret`* __string__ | The unencrypted OIDC Client Secret. This will only be shared upon creation and cannot be recovered if lost. +
|
|
| *`totalClientSecrets`* __integer__ | The total number of client secrets associated with the OIDCClient referenced by the metadata.name field. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-config-concierge-pinniped-dev-v1alpha1"]
|
|
=== config.concierge.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped concierge configuration API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuer"]
|
|
==== CredentialIssuer
|
|
|
|
CredentialIssuer describes the configuration and status of the Pinniped Concierge credential issuer.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerlist[$$CredentialIssuerList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerspec[$$CredentialIssuerSpec$$]__ | Spec describes the intended configuration of the Concierge. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]__ | CredentialIssuerStatus describes the status of the Concierge. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerfrontend"]
|
|
==== CredentialIssuerFrontend
|
|
|
|
CredentialIssuerFrontend describes how to connect using a particular integration strategy.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`type`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-frontendtype[$$FrontendType$$]__ | Type describes which frontend mechanism clients can use with a strategy. +
|
|
| *`tokenCredentialRequestInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-tokencredentialrequestapiinfo[$$TokenCredentialRequestAPIInfo$$]__ | TokenCredentialRequestAPIInfo describes the parameters for the TokenCredentialRequest API on this Concierge. +
|
|
This field is only set when Type is "TokenCredentialRequestAPI". +
|
|
| *`impersonationProxyInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyinfo[$$ImpersonationProxyInfo$$]__ | ImpersonationProxyInfo describes the parameters for the impersonation proxy on this Concierge. +
|
|
This field is only set when Type is "ImpersonationProxy". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerkubeconfiginfo"]
|
|
==== CredentialIssuerKubeConfigInfo
|
|
|
|
CredentialIssuerKubeConfigInfo provides the information needed to form a valid Pinniped-based kubeconfig using this credential issuer.
|
|
This type is deprecated and will be removed in a future version.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`server`* __string__ | The K8s API server URL. +
|
|
| *`certificateAuthorityData`* __string__ | The K8s API server CA bundle. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerspec"]
|
|
==== CredentialIssuerSpec
|
|
|
|
CredentialIssuerSpec describes the intended configuration of the Concierge.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuer[$$CredentialIssuer$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`impersonationProxy`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyspec[$$ImpersonationProxySpec$$]__ | ImpersonationProxy describes the intended configuration of the Concierge impersonation proxy. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstatus"]
|
|
==== CredentialIssuerStatus
|
|
|
|
CredentialIssuerStatus describes the status of the Concierge.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuer[$$CredentialIssuer$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`strategies`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$] array__ | List of integration strategies that were attempted by Pinniped. +
|
|
| *`kubeConfigInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerkubeconfiginfo[$$CredentialIssuerKubeConfigInfo$$]__ | Information needed to form a valid Pinniped-based kubeconfig using this credential issuer. +
|
|
This field is deprecated and will be removed in a future version. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy"]
|
|
==== CredentialIssuerStrategy
|
|
|
|
CredentialIssuerStrategy describes the status of an integration strategy that was attempted by Pinniped.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstatus[$$CredentialIssuerStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`type`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategytype[$$StrategyType$$]__ | Type of integration attempted. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategystatus[$$StrategyStatus$$]__ | Status of the attempted integration strategy. +
|
|
| *`reason`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategyreason[$$StrategyReason$$]__ | Reason for the current status. +
|
|
| *`message`* __string__ | Human-readable description of the current status. +
|
|
| *`lastUpdateTime`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#time-v1-meta[$$Time$$]__ | When the status was last checked. +
|
|
| *`frontend`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerfrontend[$$CredentialIssuerFrontend$$]__ | Frontend describes how clients can connect using this strategy. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-frontendtype"]
|
|
==== FrontendType (string)
|
|
|
|
FrontendType enumerates a type of "frontend" used to provide access to users of a cluster.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerfrontend[$$CredentialIssuerFrontend$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyinfo"]
|
|
==== ImpersonationProxyInfo
|
|
|
|
ImpersonationProxyInfo describes the parameters for the impersonation proxy on this Concierge.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerfrontend[$$CredentialIssuerFrontend$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`endpoint`* __string__ | Endpoint is the HTTPS endpoint of the impersonation proxy. +
|
|
| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded PEM CA bundle of the impersonation proxy. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxymode"]
|
|
==== ImpersonationProxyMode (string)
|
|
|
|
ImpersonationProxyMode enumerates the configuration modes for the impersonation proxy.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyspec[$$ImpersonationProxySpec$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyservicespec"]
|
|
==== ImpersonationProxyServiceSpec
|
|
|
|
ImpersonationProxyServiceSpec describes how the Concierge should provision a Service to expose the impersonation proxy.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyspec[$$ImpersonationProxySpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`type`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyservicetype[$$ImpersonationProxyServiceType$$]__ | Type specifies the type of Service to provision for the impersonation proxy. +
|
|
|
|
|
|
If the type is "None", then the "spec.impersonationProxy.externalEndpoint" field must be set to a non-empty +
|
|
value so that the Concierge can properly advertise the endpoint in the CredentialIssuer's status. +
|
|
| *`loadBalancerIP`* __string__ | LoadBalancerIP specifies the IP address to set in the spec.loadBalancerIP field of the provisioned Service. +
|
|
This is not supported on all cloud providers. +
|
|
| *`annotations`* __object (keys:string, values:string)__ | Annotations specifies zero or more key/value pairs to set as annotations on the provisioned Service. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyservicetype"]
|
|
==== ImpersonationProxyServiceType (string)
|
|
|
|
ImpersonationProxyServiceType enumerates the types of service that can be provisioned for the impersonation proxy.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyservicespec[$$ImpersonationProxyServiceSpec$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyspec"]
|
|
==== ImpersonationProxySpec
|
|
|
|
ImpersonationProxySpec describes the intended configuration of the Concierge impersonation proxy.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerspec[$$CredentialIssuerSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`mode`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxymode[$$ImpersonationProxyMode$$]__ | Mode configures whether the impersonation proxy should be started: +
|
|
- "disabled" explicitly disables the impersonation proxy. This is the default. +
|
|
- "enabled" explicitly enables the impersonation proxy. +
|
|
- "auto" enables or disables the impersonation proxy based upon the cluster in which it is running. +
|
|
| *`service`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyservicespec[$$ImpersonationProxyServiceSpec$$]__ | Service describes the configuration of the Service provisioned to expose the impersonation proxy to clients. +
|
|
| *`externalEndpoint`* __string__ | ExternalEndpoint describes the HTTPS endpoint where the proxy will be exposed. If not set, the proxy will +
|
|
be served using the external name of the LoadBalancer service or the cluster service DNS name. +
|
|
|
|
|
|
This field must be non-empty when spec.impersonationProxy.service.type is "None". +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxytlsspec[$$ImpersonationProxyTLSSpec$$]__ | TLS contains information about how the Concierge impersonation proxy should serve TLS. +
|
|
|
|
|
|
If this field is empty, the impersonation proxy will generate its own TLS certificate. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxytlsspec"]
|
|
==== ImpersonationProxyTLSSpec
|
|
|
|
ImpersonationProxyTLSSpec contains information about how the Concierge impersonation proxy should
|
|
serve TLS.
|
|
|
|
|
|
If CertificateAuthorityData is not provided, the Concierge impersonation proxy will check the secret
|
|
for a field called "ca.crt", which will be used as the CertificateAuthorityData.
|
|
|
|
|
|
If neither CertificateAuthorityData nor ca.crt is provided, no CA bundle will be advertised for
|
|
the impersonation proxy endpoint.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-impersonationproxyspec[$$ImpersonationProxySpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`certificateAuthorityData`* __string__ | X.509 Certificate Authority (base64-encoded PEM bundle). +
|
|
Used to advertise the CA bundle for the impersonation proxy endpoint. +
|
|
| *`secretName`* __string__ | SecretName is the name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains +
|
|
the TLS serving certificate for the Concierge impersonation proxy endpoint. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategyreason"]
|
|
==== StrategyReason (string)
|
|
|
|
StrategyReason enumerates the detailed reason why a strategy is in a particular status.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategystatus"]
|
|
==== StrategyStatus (string)
|
|
|
|
StrategyStatus enumerates whether a strategy is working on a cluster.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-strategytype"]
|
|
==== StrategyType (string)
|
|
|
|
StrategyType enumerates a type of "strategy" used to implement credential access on a cluster.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerstrategy[$$CredentialIssuerStrategy$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-tokencredentialrequestapiinfo"]
|
|
==== TokenCredentialRequestAPIInfo
|
|
|
|
TokenCredentialRequestAPIInfo describes the parameters for the TokenCredentialRequest API on this Concierge.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-config-v1alpha1-credentialissuerfrontend[$$CredentialIssuerFrontend$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`server`* __string__ | Server is the Kubernetes API server URL. +
|
|
| *`certificateAuthorityData`* __string__ | CertificateAuthorityData is the base64-encoded Kubernetes API server CA bundle. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-config-supervisor-pinniped-dev-v1alpha1"]
|
|
=== config.supervisor.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor configuration API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomain"]
|
|
==== FederationDomain
|
|
|
|
FederationDomain describes the configuration of an OIDC provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainlist[$$FederationDomainList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainspec[$$FederationDomainSpec$$]__ | Spec of the OIDC provider. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainstatus[$$FederationDomainStatus$$]__ | Status of the OIDC provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainidentityprovider"]
|
|
==== FederationDomainIdentityProvider
|
|
|
|
FederationDomainIdentityProvider describes how an identity provider is made available in this FederationDomain.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainspec[$$FederationDomainSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`displayName`* __string__ | DisplayName is the name of this identity provider as it will appear to clients. This name ends up in the +
|
|
kubeconfig of end users, so changing the name of an identity provider that is in use by end users will be a +
|
|
disruptive change for those users. +
|
|
| *`objectRef`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#typedlocalobjectreference-v1-core[$$TypedLocalObjectReference$$]__ | ObjectRef is a reference to a Pinniped identity provider resource. A valid reference is required. +
|
|
If the reference cannot be resolved then the identity provider will not be made available. +
|
|
Must refer to a resource of one of the Pinniped identity provider types, e.g. OIDCIdentityProvider, +
|
|
LDAPIdentityProvider, ActiveDirectoryIdentityProvider. +
|
|
| *`transforms`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransforms[$$FederationDomainTransforms$$]__ | Transforms is an optional way to specify transformations to be applied during user authentication and +
|
|
session refresh. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainphase"]
|
|
==== FederationDomainPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainstatus[$$FederationDomainStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainsecrets"]
|
|
==== FederationDomainSecrets
|
|
|
|
FederationDomainSecrets holds information about this OIDC Provider's secrets.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainstatus[$$FederationDomainStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`jwks`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | JWKS holds the name of the corev1.Secret in which this OIDC Provider's signing/verification keys are +
|
|
stored. If it is empty, then the signing/verification keys are either unknown or they don't +
|
|
exist. +
|
|
| *`tokenSigningKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | TokenSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for +
|
|
signing tokens is stored. +
|
|
| *`stateSigningKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for +
|
|
signing state parameters is stored. +
|
|
| *`stateEncryptionKey`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#localobjectreference-v1-core[$$LocalObjectReference$$]__ | StateSigningKey holds the name of the corev1.Secret in which this OIDC Provider's key for +
|
|
encrypting state parameters is stored. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainspec"]
|
|
==== FederationDomainSpec
|
|
|
|
FederationDomainSpec is a struct that describes an OIDC Provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomain[$$FederationDomain$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`issuer`* __string__ | Issuer is the OIDC Provider's issuer, per the OIDC Discovery Metadata document, as well as the +
|
|
identifier that it will use for the iss claim in issued JWTs. This field will also be used as +
|
|
the base URL for any endpoints used by the OIDC Provider (e.g., if your issuer is +
|
|
https://example.com/foo, then your authorization endpoint will look like +
|
|
https://example.com/foo/some/path/to/auth/endpoint). +
|
|
|
|
|
|
See +
|
|
https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3 for more information. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintlsspec[$$FederationDomainTLSSpec$$]__ | TLS specifies a secret which will contain Transport Layer Security (TLS) configuration for the FederationDomain. +
|
|
| *`identityProviders`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainidentityprovider[$$FederationDomainIdentityProvider$$] array__ | IdentityProviders is the list of identity providers available for use by this FederationDomain. +
|
|
|
|
|
|
An identity provider CR (e.g. OIDCIdentityProvider or LDAPIdentityProvider) describes how to connect to a server, +
|
|
how to talk in a specific protocol for authentication, and how to use the schema of that server/protocol to +
|
|
extract a normalized user identity. Normalized user identities include a username and a list of group names. +
|
|
In contrast, IdentityProviders describes how to use that normalized identity in those Kubernetes clusters which +
|
|
belong to this FederationDomain. Each entry in IdentityProviders can be configured with arbitrary transformations +
|
|
on that normalized identity. For example, a transformation can add a prefix to all usernames to help avoid +
|
|
accidental conflicts when multiple identity providers have different users with the same username (e.g. +
|
|
"idp1:ryan" versus "idp2:ryan"). Each entry in IdentityProviders can also implement arbitrary authentication +
|
|
rejection policies. Even though a user was able to authenticate with the identity provider, a policy can disallow +
|
|
the authentication to the Kubernetes clusters that belong to this FederationDomain. For example, a policy could +
|
|
disallow the authentication unless the user belongs to a specific group in the identity provider. +
|
|
|
|
|
|
For backwards compatibility with versions of Pinniped which predate support for multiple identity providers, +
|
|
an empty IdentityProviders list will cause the FederationDomain to use all available identity providers which +
|
|
exist in the same namespace, but also to reject all authentication requests when there is more than one identity +
|
|
provider currently defined. In this backwards compatibility mode, the name of the identity provider resource +
|
|
(e.g. the Name of an OIDCIdentityProvider resource) will be used as the name of the identity provider in this +
|
|
FederationDomain. This mode is provided to make upgrading from older versions easier. However, instead of +
|
|
relying on this backwards compatibility mode, please consider this mode to be deprecated and please instead +
|
|
explicitly list the identity provider using this IdentityProviders field. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainstatus"]
|
|
==== FederationDomainStatus
|
|
|
|
FederationDomainStatus is a struct that describes the actual state of an OIDC Provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomain[$$FederationDomain$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainphase[$$FederationDomainPhase$$]__ | Phase summarizes the overall status of the FederationDomain. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Conditions represent the observations of an FederationDomain's current state. +
|
|
| *`secrets`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainsecrets[$$FederationDomainSecrets$$]__ | Secrets contains information about this OIDC Provider's secrets. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintlsspec"]
|
|
==== FederationDomainTLSSpec
|
|
|
|
FederationDomainTLSSpec is a struct that describes the TLS configuration for an OIDC Provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainspec[$$FederationDomainSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`secretName`* __string__ | SecretName is an optional name of a Secret in the same namespace, of type `kubernetes.io/tls`, which contains +
|
|
the TLS serving certificate for the HTTPS endpoints served by this FederationDomain. When provided, the TLS Secret +
|
|
named here must contain keys named `tls.crt` and `tls.key` that contain the certificate and private key to use +
|
|
for TLS. +
|
|
|
|
|
|
Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) supported by all major browsers. +
|
|
|
|
|
|
SecretName is required if you would like to use different TLS certificates for issuers of different hostnames. +
|
|
SNI requests do not include port numbers, so all issuers with the same DNS hostname must use the same +
|
|
SecretName value even if they have different port numbers. +
|
|
|
|
|
|
SecretName is not required when you would like to use only the HTTP endpoints (e.g. when the HTTP listener is +
|
|
configured to listen on loopback interfaces or UNIX domain sockets for traffic from a service mesh sidecar). +
|
|
It is also not required when you would like all requests to this OIDC Provider's HTTPS endpoints to +
|
|
use the default TLS certificate, which is configured elsewhere. +
|
|
|
|
|
|
When your Issuer URL's host is an IP address, then this field is ignored. SNI does not work for IP addresses. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransforms"]
|
|
==== FederationDomainTransforms
|
|
|
|
FederationDomainTransforms defines identity transformations for an identity provider's usage on a FederationDomain.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomainidentityprovider[$$FederationDomainIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`constants`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsconstant[$$FederationDomainTransformsConstant$$] array__ | Constants defines constant variables and their values which will be made available to the transform expressions. +
|
|
| *`expressions`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexpression[$$FederationDomainTransformsExpression$$] array__ | Expressions are an optional list of transforms and policies to be executed in the order given during every +
|
|
authentication attempt, including during every session refresh. +
|
|
Each is a CEL expression. It may use the basic CEL language as defined in +
|
|
https://github.com/google/cel-spec/blob/master/doc/langdef.md plus the CEL string extensions defined in +
|
|
https://github.com/google/cel-go/tree/master/ext#strings. +
|
|
|
|
|
|
The username and groups extracted from the identity provider, and the constants defined in this CR, are +
|
|
available as variables in all expressions. The username is provided via a variable called `username` and +
|
|
the list of group names is provided via a variable called `groups` (which may be an empty list). +
|
|
Each user-provided constants is provided via a variable named `strConst.varName` for string constants +
|
|
and `strListConst.varName` for string list constants. +
|
|
|
|
|
|
The only allowed types for expressions are currently policy/v1, username/v1, and groups/v1. +
|
|
Each policy/v1 must return a boolean, and when it returns false, no more expressions from the list are evaluated +
|
|
and the authentication attempt is rejected. +
|
|
Transformations of type policy/v1 do not return usernames or group names, and therefore cannot change the +
|
|
username or group names. +
|
|
Each username/v1 transform must return the new username (a string), which can be the same as the old username. +
|
|
Transformations of type username/v1 do not return group names, and therefore cannot change the group names. +
|
|
Each groups/v1 transform must return the new groups list (list of strings), which can be the same as the old +
|
|
groups list. +
|
|
Transformations of type groups/v1 do not return usernames, and therefore cannot change the usernames. +
|
|
After each expression, the new (potentially changed) username or groups get passed to the following expression. +
|
|
|
|
|
|
Any compilation or static type-checking failure of any expression will cause an error status on the FederationDomain. +
|
|
During an authentication attempt, any unexpected runtime evaluation errors (e.g. division by zero) cause the +
|
|
authentication attempt to fail. When all expressions evaluate successfully, then the (potentially changed) username +
|
|
and group names have been decided for that authentication attempt. +
|
|
| *`examples`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexample[$$FederationDomainTransformsExample$$] array__ | Examples can optionally be used to ensure that the sequence of transformation expressions are working as +
|
|
expected. Examples define sample input identities which are then run through the expression list, and the +
|
|
results are compared to the expected results. If any example in this list fails, then this +
|
|
identity provider will not be available for use within this FederationDomain, and the error(s) will be +
|
|
added to the FederationDomain status. This can be used to help guard against programming mistakes in the +
|
|
expressions, and also act as living documentation for other administrators to better understand the expressions. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsconstant"]
|
|
==== FederationDomainTransformsConstant
|
|
|
|
FederationDomainTransformsConstant defines a constant variable and its value which will be made available to
|
|
the transform expressions. This is a union type, and Type is the discriminator field.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransforms[$$FederationDomainTransforms$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`name`* __string__ | Name determines the name of the constant. It must be a valid identifier name. +
|
|
| *`type`* __string__ | Type determines the type of the constant, and indicates which other field should be non-empty. +
|
|
| *`stringValue`* __string__ | StringValue should hold the value when Type is "string", and is otherwise ignored. +
|
|
| *`stringListValue`* __string array__ | StringListValue should hold the value when Type is "stringList", and is otherwise ignored. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexample"]
|
|
==== FederationDomainTransformsExample
|
|
|
|
FederationDomainTransformsExample defines a transform example.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransforms[$$FederationDomainTransforms$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __string__ | Username is the input username. +
|
|
| *`groups`* __string array__ | Groups is the input list of group names. +
|
|
| *`expects`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexampleexpects[$$FederationDomainTransformsExampleExpects$$]__ | Expects is the expected output of the entire sequence of transforms when they are run against the +
|
|
input Username and Groups. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexampleexpects"]
|
|
==== FederationDomainTransformsExampleExpects
|
|
|
|
FederationDomainTransformsExampleExpects defines the expected result for a transforms example.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexample[$$FederationDomainTransformsExample$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __string__ | Username is the expected username after the transformations have been applied. +
|
|
| *`groups`* __string array__ | Groups is the expected list of group names after the transformations have been applied. +
|
|
| *`rejected`* __boolean__ | Rejected is a boolean that indicates whether authentication is expected to be rejected by a policy expression +
|
|
after the transformations have been applied. True means that it is expected that the authentication would be +
|
|
rejected. The default value of false means that it is expected that the authentication would not be rejected +
|
|
by any policy expression. +
|
|
| *`message`* __string__ | Message is the expected error message of the transforms. When Rejected is true, then Message is the expected +
|
|
message for the policy which rejected the authentication attempt. When Rejected is true and Message is blank, +
|
|
then Message will be treated as the default error message for authentication attempts which are rejected by a +
|
|
policy. When Rejected is false, then Message is the expected error message for some other non-policy +
|
|
transformation error, such as a runtime error. When Rejected is false, there is no default expected Message. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransformsexpression"]
|
|
==== FederationDomainTransformsExpression
|
|
|
|
FederationDomainTransformsExpression defines a transform expression.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-federationdomaintransforms[$$FederationDomainTransforms$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`type`* __string__ | Type determines the type of the expression. It must be one of the supported types. +
|
|
| *`expression`* __string__ | Expression is a CEL expression that will be evaluated based on the Type during an authentication. +
|
|
| *`message`* __string__ | Message is only used when Type is policy/v1. It defines an error message to be used when the policy rejects +
|
|
an authentication attempt. When empty, a default message will be used. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-granttype"]
|
|
==== GrantType (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclient"]
|
|
==== OIDCClient
|
|
|
|
OIDCClient describes the configuration of an OIDC client.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientlist[$$OIDCClientList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]__ | Spec of the OIDC client. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]__ | Status of the OIDC client. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientphase"]
|
|
==== OIDCClientPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientstatus[$$OIDCClientStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec"]
|
|
==== OIDCClientSpec
|
|
|
|
OIDCClientSpec is a struct that describes an OIDCClient.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclient[$$OIDCClient$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`allowedRedirectURIs`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-redirecturi[$$RedirectURI$$] array__ | allowedRedirectURIs is a list of the allowed redirect_uri param values that should be accepted during OIDC flows with this +
|
|
client. Any other uris will be rejected. +
|
|
Must be a URI with the https scheme, unless the hostname is 127.0.0.1 or ::1 which may use the http scheme. +
|
|
Port numbers are not required for 127.0.0.1 or ::1 and are ignored when checking for a matching redirect_uri. +
|
|
| *`allowedGrantTypes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-granttype[$$GrantType$$] array__ | allowedGrantTypes is a list of the allowed grant_type param values that should be accepted during OIDC flows with this +
|
|
client. +
|
|
|
|
|
|
Must only contain the following values: +
|
|
- authorization_code: allows the client to perform the authorization code grant flow, i.e. allows the webapp to +
|
|
authenticate users. This grant must always be listed. +
|
|
- refresh_token: allows the client to perform refresh grants for the user to extend the user's session. +
|
|
This grant must be listed if allowedScopes lists offline_access. +
|
|
- urn:ietf:params:oauth:grant-type:token-exchange: allows the client to perform RFC8693 token exchange, +
|
|
which is a step in the process to be able to get a cluster credential for the user. +
|
|
This grant must be listed if allowedScopes lists pinniped:request-audience. +
|
|
| *`allowedScopes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-scope[$$Scope$$] array__ | allowedScopes is a list of the allowed scopes param values that should be accepted during OIDC flows with this client. +
|
|
|
|
|
|
Must only contain the following values: +
|
|
- openid: The client is allowed to request ID tokens. ID tokens only include the required claims by default (iss, sub, aud, exp, iat). +
|
|
This scope must always be listed. +
|
|
- offline_access: The client is allowed to request an initial refresh token during the authorization code grant flow. +
|
|
This scope must be listed if allowedGrantTypes lists refresh_token. +
|
|
- pinniped:request-audience: The client is allowed to request a new audience value during a RFC8693 token exchange, +
|
|
which is a step in the process to be able to get a cluster credential for the user. +
|
|
openid, username and groups scopes must be listed when this scope is present. +
|
|
This scope must be listed if allowedGrantTypes lists urn:ietf:params:oauth:grant-type:token-exchange. +
|
|
- username: The client is allowed to request that ID tokens contain the user's username. +
|
|
Without the username scope being requested and allowed, the ID token will not contain the user's username. +
|
|
- groups: The client is allowed to request that ID tokens contain the user's group membership, +
|
|
if their group membership is discoverable by the Supervisor. +
|
|
Without the groups scope being requested and allowed, the ID token will not contain groups. +
|
|
| *`tokenLifetimes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclienttokenlifetimes[$$OIDCClientTokenLifetimes$$]__ | tokenLifetimes are the optional overrides of token lifetimes for an OIDCClient. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientstatus"]
|
|
==== OIDCClientStatus
|
|
|
|
OIDCClientStatus is a struct that describes the actual state of an OIDCClient.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclient[$$OIDCClient$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientphase[$$OIDCClientPhase$$]__ | phase summarizes the overall status of the OIDCClient. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | conditions represent the observations of an OIDCClient's current state. +
|
|
| *`totalClientSecrets`* __integer__ | totalClientSecrets is the current number of client secrets that are detected for this OIDCClient. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclienttokenlifetimes"]
|
|
==== OIDCClientTokenLifetimes
|
|
|
|
OIDCClientTokenLifetimes describes the optional overrides of token lifetimes for an OIDCClient.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`idTokenSeconds`* __integer__ | idTokenSeconds is the lifetime of ID tokens issued to this client, in seconds. This will choose the lifetime of +
|
|
ID tokens returned by the authorization flow and the refresh grant. It will not influence the lifetime of the ID +
|
|
tokens returned by RFC8693 token exchange. When null, a short-lived default value will be used. +
|
|
This value must be between 120 and 1,800 seconds (30 minutes), inclusive. It is recommended to make these tokens +
|
|
short-lived to force the client to perform the refresh grant often, because the refresh grant will check with the +
|
|
external identity provider to decide if it is acceptable for the end user to continue their session, and will +
|
|
update the end user's group memberships from the external identity provider. Giving these tokens a long life is +
|
|
will allow the end user to continue to use a token while avoiding these updates from the external identity +
|
|
provider. However, some web applications may have reasons specific to the design of that application to prefer +
|
|
longer lifetimes. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-redirecturi"]
|
|
==== RedirectURI (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-scope"]
|
|
==== Scope (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-config-v1alpha1-oidcclientspec[$$OIDCClientSpec$$]
|
|
****
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-identity-concierge-pinniped-dev-identity"]
|
|
=== identity.concierge.pinniped.dev/identity
|
|
|
|
Package identity is the internal version of the Pinniped identity API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-extravalue"]
|
|
==== ExtraValue (string array)
|
|
|
|
ExtraValue masks the value so protobuf can generate
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-userinfo[$$UserInfo$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-kubernetesuserinfo"]
|
|
==== KubernetesUserInfo
|
|
|
|
KubernetesUserInfo represents the current authenticated user, exactly as Kubernetes understands it.
|
|
Copied from the Kubernetes token review API.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`User`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-userinfo[$$UserInfo$$]__ | User is the UserInfo associated with the current user. +
|
|
| *`Audiences`* __string array__ | Audiences are audience identifiers chosen by the authenticator. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-userinfo"]
|
|
==== UserInfo
|
|
|
|
UserInfo holds the information about the user needed to implement the
|
|
user.Info interface.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-kubernetesuserinfo[$$KubernetesUserInfo$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`Username`* __string__ | The name that uniquely identifies this user among all active users. +
|
|
| *`UID`* __string__ | A unique value that identifies this user across time. If this user is +
|
|
deleted and another user by the same name is added, they will have +
|
|
different UIDs. +
|
|
| *`Groups`* __string array__ | The names of groups this user is a part of. +
|
|
| *`Extra`* __object (keys:string, values:xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-extravalue[$$ExtraValue$$])__ | Any additional information provided by the authenticator. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequest"]
|
|
==== WhoAmIRequest
|
|
|
|
WhoAmIRequest submits a request to echo back the current authenticated user.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequestlist[$$WhoAmIRequestList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ |
|
|
| *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ |
|
|
| *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ |
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequestspec"]
|
|
==== WhoAmIRequestSpec
|
|
|
|
Spec is always empty for a WhoAmIRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequest[$$WhoAmIRequest$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequeststatus"]
|
|
==== WhoAmIRequestStatus
|
|
|
|
Status is set by the server in the response to a WhoAmIRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-whoamirequest[$$WhoAmIRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`KubernetesUserInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-kubernetesuserinfo[$$KubernetesUserInfo$$]__ | The current authenticated user, exactly as Kubernetes understands it. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-identity-concierge-pinniped-dev-v1alpha1"]
|
|
=== identity.concierge.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped identity API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-extravalue"]
|
|
==== ExtraValue (string array)
|
|
|
|
ExtraValue masks the value so protobuf can generate
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-userinfo[$$UserInfo$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-kubernetesuserinfo"]
|
|
==== KubernetesUserInfo
|
|
|
|
KubernetesUserInfo represents the current authenticated user, exactly as Kubernetes understands it.
|
|
Copied from the Kubernetes token review API.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequeststatus[$$WhoAmIRequestStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`user`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-userinfo[$$UserInfo$$]__ | User is the UserInfo associated with the current user. +
|
|
| *`audiences`* __string array__ | Audiences are audience identifiers chosen by the authenticator. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-userinfo"]
|
|
==== UserInfo
|
|
|
|
UserInfo holds the information about the user needed to implement the
|
|
user.Info interface.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-kubernetesuserinfo[$$KubernetesUserInfo$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __string__ | The name that uniquely identifies this user among all active users. +
|
|
| *`uid`* __string__ | A unique value that identifies this user across time. If this user is +
|
|
deleted and another user by the same name is added, they will have +
|
|
different UIDs. +
|
|
| *`groups`* __string array__ | The names of groups this user is a part of. +
|
|
| *`extra`* __object (keys:string, values:xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-extravalue[$$ExtraValue$$])__ | Any additional information provided by the authenticator. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequest"]
|
|
==== WhoAmIRequest
|
|
|
|
WhoAmIRequest submits a request to echo back the current authenticated user.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequestlist[$$WhoAmIRequestList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequestspec[$$WhoAmIRequestSpec$$]__ |
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ |
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequestspec"]
|
|
==== WhoAmIRequestSpec
|
|
|
|
Spec is always empty for a WhoAmIRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequest[$$WhoAmIRequest$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequeststatus"]
|
|
==== WhoAmIRequestStatus
|
|
|
|
Status is set by the server in the response to a WhoAmIRequest.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-whoamirequest[$$WhoAmIRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`kubernetesUserInfo`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-identity-v1alpha1-kubernetesuserinfo[$$KubernetesUserInfo$$]__ | The current authenticated user, exactly as Kubernetes understands it. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-idp-supervisor-pinniped-dev-v1alpha1"]
|
|
=== idp.supervisor.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped supervisor identity provider (IDP) API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovider"]
|
|
==== ActiveDirectoryIdentityProvider
|
|
|
|
ActiveDirectoryIdentityProvider describes the configuration of an upstream Microsoft Active Directory identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderlist[$$ActiveDirectoryIdentityProviderList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderstatus[$$ActiveDirectoryIdentityProviderStatus$$]__ | Status of the identity provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderbind"]
|
|
==== ActiveDirectoryIdentityProviderBind
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the username and +
|
|
password for an Active Directory bind user. This account will be used to perform LDAP searches. The Secret should be +
|
|
of type "kubernetes.io/basic-auth" which includes "username" and "password" keys. The username value +
|
|
should be the full dn (distinguished name) of your bind account, e.g. "cn=bind-account,ou=users,dc=example,dc=com". +
|
|
The password must be non-empty. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearch"]
|
|
==== ActiveDirectoryIdentityProviderGroupSearch
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. +
|
|
"ou=groups,dc=example,dc=com". +
|
|
Optional, when not specified it will be based on the result of a query for the defaultNamingContext +
|
|
(see https://docs.microsoft.com/en-us/windows/win32/adschema/rootdse). +
|
|
The default behavior searches your entire domain for groups. +
|
|
It may make sense to specify a subtree as a search base if you wish to exclude some groups +
|
|
for security reasons or to make searches faster. +
|
|
| *`filter`* __string__ | Filter is the ActiveDirectory search filter which should be applied when searching for groups for a user. +
|
|
The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the +
|
|
value of an attribute of the user entry found as a result of the user search. Which attribute's +
|
|
value is used to replace the placeholder(s) depends on the value of UserAttributeForFilter. +
|
|
E.g. "member={}" or "&(objectClass=groupOfNames)(member={})". +
|
|
For more information about ActiveDirectory filters, see https://ldap.com/ldap-filters. +
|
|
Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. +
|
|
Optional. When not specified, the default will act as if the filter were specified as +
|
|
"(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={})". +
|
|
This searches nested groups by default. +
|
|
Note that nested group search can be slow for some Active Directory servers. To disable it, +
|
|
you can set the filter to +
|
|
"(&(objectClass=group)(member={})" +
|
|
| *`userAttributeForFilter`* __string__ | UserAttributeForFilter specifies which attribute's value from the user entry found as a result of +
|
|
the user search will be used to replace the "{}" placeholder(s) in the group search Filter. +
|
|
For example, specifying "uid" as the UserAttributeForFilter while specifying +
|
|
"&(objectClass=posixGroup)(memberUid={})" as the Filter would search for groups by replacing +
|
|
the "{}" placeholder in the Filter with the value of the user's "uid" attribute. +
|
|
Optional. When not specified, the default will act as if "dn" were specified. For example, leaving +
|
|
UserAttributeForFilter unspecified while specifying "&(objectClass=groupOfNames)(member={})" as the Filter +
|
|
would search for groups by replacing the "{}" placeholder(s) with the dn (distinguished name) of the user. +
|
|
| *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes[$$ActiveDirectoryIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each ActiveDirectory entry which was found as +
|
|
the result of the group search. +
|
|
| *`skipGroupRefresh`* __boolean__ | The user's group membership is refreshed as they interact with the supervisor +
|
|
to obtain new credentials (as their old credentials expire). This allows group +
|
|
membership changes to be quickly reflected into Kubernetes clusters. Since +
|
|
group membership is often used to bind authorization policies, it is important +
|
|
to keep the groups observed in Kubernetes clusters in-sync with the identity +
|
|
provider. +
|
|
|
|
|
|
In some environments, frequent group membership queries may result in a +
|
|
significant performance impact on the identity provider and/or the supervisor. +
|
|
The best approach to handle performance impacts is to tweak the group query +
|
|
to be more performant, for example by disabling nested group search or by +
|
|
using a more targeted group search base. +
|
|
|
|
|
|
If the group search query cannot be made performant and you are willing to +
|
|
have group memberships remain static for approximately a day, then set +
|
|
skipGroupRefresh to true. This is an insecure configuration as authorization +
|
|
policies that are bound to group membership will not notice if a user has +
|
|
been removed from a particular group until their next login. +
|
|
|
|
|
|
This is an experimental feature that may be removed or significantly altered +
|
|
in the future. Consumers of this configuration should carefully read all +
|
|
release notes before upgrading to ensure that the meaning of this field has +
|
|
not changed. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearchattributes"]
|
|
==== ActiveDirectoryIdentityProviderGroupSearchAttributes
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearch[$$ActiveDirectoryIdentityProviderGroupSearch$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`groupName`* __string__ | GroupName specifies the name of the attribute in the Active Directory entries whose value shall become a group name +
|
|
in the user's list of groups after a successful authentication. +
|
|
The value of this field is case-sensitive and must match the case of the attribute name returned by the ActiveDirectory +
|
|
server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". +
|
|
Optional. When not specified, this defaults to a custom field that looks like "sAMAccountName@domain", +
|
|
where domain is constructed from the domain components of the group DN. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderphase"]
|
|
==== ActiveDirectoryIdentityProviderPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderstatus[$$ActiveDirectoryIdentityProviderStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec"]
|
|
==== ActiveDirectoryIdentityProviderSpec
|
|
|
|
Spec for configuring an ActiveDirectory identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovider[$$ActiveDirectoryIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`host`* __string__ | Host is the hostname of this Active Directory identity provider, i.e., where to connect. For example: ldap.example.com:636. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS contains the connection settings for how to establish the connection to the Host. +
|
|
| *`bind`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderbind[$$ActiveDirectoryIdentityProviderBind$$]__ | Bind contains the configuration for how to provide access credentials during an initial bind to the ActiveDirectory server +
|
|
to be allowed to perform searches and binds to validate a user's credentials during a user's authentication attempt. +
|
|
| *`userSearch`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearch[$$ActiveDirectoryIdentityProviderUserSearch$$]__ | UserSearch contains the configuration for searching for a user by name in Active Directory. +
|
|
| *`groupSearch`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovidergroupsearch[$$ActiveDirectoryIdentityProviderGroupSearch$$]__ | GroupSearch contains the configuration for searching for a user's group membership in ActiveDirectory. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderstatus"]
|
|
==== ActiveDirectoryIdentityProviderStatus
|
|
|
|
Status of an Active Directory identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityprovider[$$ActiveDirectoryIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderphase[$$ActiveDirectoryIdentityProviderPhase$$]__ | Phase summarizes the overall status of the ActiveDirectoryIdentityProvider. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Represents the observations of an identity provider's current state. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearch"]
|
|
==== ActiveDirectoryIdentityProviderUserSearch
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. +
|
|
E.g. "ou=users,dc=example,dc=com". +
|
|
Optional, when not specified it will be based on the result of a query for the defaultNamingContext +
|
|
(see https://docs.microsoft.com/en-us/windows/win32/adschema/rootdse). +
|
|
The default behavior searches your entire domain for users. +
|
|
It may make sense to specify a subtree as a search base if you wish to exclude some users +
|
|
or to make searches faster. +
|
|
| *`filter`* __string__ | Filter is the search filter which should be applied when searching for users. The pattern "{}" must occur +
|
|
in the filter at least once and will be dynamically replaced by the username for which the search is being run. +
|
|
E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see +
|
|
https://ldap.com/ldap-filters. +
|
|
Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. +
|
|
Optional. When not specified, the default will be +
|
|
'(&(objectClass=person)(!(objectClass=computer))(!(showInAdvancedViewOnly=TRUE))(\|(sAMAccountName={}")(mail={})(userPrincipalName={})(sAMAccountType=805306368))' +
|
|
This means that the user is a person, is not a computer, the sAMAccountType is for a normal user account, +
|
|
and is not shown in advanced view only +
|
|
(which would likely mean its a system created service account with advanced permissions). +
|
|
Also, either the sAMAccountName, the userPrincipalName, or the mail attribute matches the input username. +
|
|
| *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes[$$ActiveDirectoryIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the ActiveDirectory entry which was found as +
|
|
the result of the user search. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearchattributes"]
|
|
==== ActiveDirectoryIdentityProviderUserSearchAttributes
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderusersearch[$$ActiveDirectoryIdentityProviderUserSearch$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __string__ | Username specifies the name of the attribute in Active Directory entry whose value shall become the username +
|
|
of the user after a successful authentication. +
|
|
Optional, when empty this defaults to "userPrincipalName". +
|
|
| *`uid`* __string__ | UID specifies the name of the attribute in the ActiveDirectory entry which whose value shall be used to uniquely +
|
|
identify the user within this ActiveDirectory provider after a successful authentication. +
|
|
Optional, when empty this defaults to "objectGUID". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-cabundlesource"]
|
|
==== CABundleSource
|
|
|
|
CABundleSource provides a source for CA bundle used for client-side TLS verification.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`kind`* __string__ | Whether the CA bundle is being sourced from a kubernetes secret or a configmap. +
|
|
Secrets must be of type kubernetes.io/tls or Opaque. +
|
|
For configmaps, the value associated with the key is not expected to be base64 encoded. +
|
|
| *`name`* __string__ | Name of the secret or configmap from which to read the CA bundle. +
|
|
The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed. +
|
|
| *`key`* __string__ | Key within the secret or configmap from which to read the CA bundle. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubapiconfig"]
|
|
==== GitHubAPIConfig
|
|
|
|
GitHubAPIConfig allows configuration for GitHub Enterprise Server
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`host`* __string__ | Host is required only for GitHub Enterprise Server. +
|
|
Defaults to using GitHub's public API ("github.com"). +
|
|
Do not specify a protocol or scheme since "https://" will always be used. +
|
|
Port is optional. Do not specify a path, query, fragment, or userinfo. +
|
|
Only domain name or IP address, subdomains (optional), and port (optional). +
|
|
IPv4 and IPv6 are supported. If using an IPv6 address with a port, you must enclose the IPv6 address +
|
|
in square brackets. Example: "[::1]:443". +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for GitHub Enterprise Server. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec"]
|
|
==== GitHubAllowAuthenticationSpec
|
|
|
|
GitHubAllowAuthenticationSpec allows customization of who can authenticate using this IDP and how.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`organizations`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]__ | Organizations allows customization of which organizations can authenticate using this IDP. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy"]
|
|
==== GitHubAllowedAuthOrganizationsPolicy (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuborganizationsspec[$$GitHubOrganizationsSpec$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclaims"]
|
|
==== GitHubClaims
|
|
|
|
GitHubClaims allows customization of the username and groups claims.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubusernameattribute[$$GitHubUsernameAttribute$$]__ | Username configures which property of the GitHub user record shall determine the username in Kubernetes. +
|
|
|
|
|
|
Can be either "id", "login", or "login:id". Defaults to "login:id". +
|
|
|
|
|
|
GitHub's user login attributes can only contain alphanumeric characters and non-repeating hyphens, +
|
|
and may not start or end with hyphens. GitHub users are allowed to change their login name, +
|
|
although it is inconvenient. If a GitHub user changed their login name from "foo" to "bar", +
|
|
then a second user might change their name from "baz" to "foo" in order to take the old +
|
|
username of the first user. For this reason, it is not as safe to make authorization decisions +
|
|
based only on the user's login attribute. +
|
|
|
|
|
|
If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
|
|
FederationDomain to further customize how these usernames are presented to Kubernetes. +
|
|
|
|
|
|
Defaults to "login:id", which is the user login attribute, followed by a colon, followed by the unique and +
|
|
unchanging integer ID number attribute. This blends human-readable login names with the unchanging ID value +
|
|
from GitHub. Colons are not allowed in GitHub login attributes or ID numbers, so this is a reasonable +
|
|
choice to concatenate the two values. +
|
|
|
|
|
|
See the response schema for +
|
|
[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user). +
|
|
| *`groups`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubgroupnameattribute[$$GitHubGroupNameAttribute$$]__ | Groups configures which property of the GitHub team record shall determine the group names in Kubernetes. +
|
|
|
|
|
|
Can be either "name" or "slug". Defaults to "slug". +
|
|
|
|
|
|
GitHub team names can contain upper and lower case characters, whitespace, and punctuation (e.g. "Kube admins!"). +
|
|
|
|
|
|
GitHub team slugs are lower case alphanumeric characters and may contain dashes and underscores (e.g. "kube-admins"). +
|
|
|
|
|
|
Group names as presented to Kubernetes will always be prefixed by the GitHub organization name followed by a +
|
|
forward slash (e.g. "my-org/my-team"). GitHub organization login names can only contain alphanumeric characters +
|
|
or single hyphens, so the first forward slash `/` will be the separator between the organization login name and +
|
|
the team name or slug. +
|
|
|
|
|
|
If desired, an admin could configure identity transformation expressions on the Pinniped Supervisor's +
|
|
FederationDomain to further customize how these group names are presented to Kubernetes. +
|
|
|
|
|
|
See the response schema for +
|
|
[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user). +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclientspec"]
|
|
==== GitHubClientSpec
|
|
|
|
GitHubClientSpec contains information about the GitHub client that this identity provider will use
|
|
for web-based login flows.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and +
|
|
clientSecret for an GitHub App or GitHub OAuth2 client. +
|
|
|
|
|
|
This secret must be of type "secrets.pinniped.dev/github-client" with keys "clientID" and "clientSecret". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubgroupnameattribute"]
|
|
==== GitHubGroupNameAttribute (string)
|
|
|
|
GitHubGroupNameAttribute allows the user to specify which attribute from GitHub to use for the group
|
|
names to present to Kubernetes. See the response schema for
|
|
[List teams for the authenticated user](https://docs.github.com/en/rest/teams/teams?apiVersion=2022-11-28#list-teams-for-the-authenticated-user).
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityprovider"]
|
|
==== GitHubIdentityProvider
|
|
|
|
GitHubIdentityProvider describes the configuration of an upstream GitHub identity provider.
|
|
This upstream provider can be configured with either a GitHub App or a GitHub OAuth2 App.
|
|
|
|
|
|
Right now, only web-based logins are supported, for both the pinniped-cli client and clients configured
|
|
as OIDCClients.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderlist[$$GitHubIdentityProviderList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec[$$GitHubIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]__ | Status of the identity provider. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderphase"]
|
|
==== GitHubIdentityProviderPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus[$$GitHubIdentityProviderStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderspec"]
|
|
==== GitHubIdentityProviderSpec
|
|
|
|
GitHubIdentityProviderSpec is the spec for configuring an GitHub identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`githubAPI`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]__ | GitHubAPI allows configuration for GitHub Enterprise Server +
|
|
| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]__ | Claims allows customization of the username and groups claims. +
|
|
| *`allowAuthentication`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]__ | AllowAuthentication allows customization of who can authenticate using this IDP and how. +
|
|
| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclientspec[$$GitHubClientSpec$$]__ | Client identifies the secret with credentials for a GitHub App or GitHub OAuth2 App (a GitHub client). +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderstatus"]
|
|
==== GitHubIdentityProviderStatus
|
|
|
|
GitHubIdentityProviderStatus is the status of an GitHub identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityprovider[$$GitHubIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubidentityproviderphase[$$GitHubIdentityProviderPhase$$]__ | Phase summarizes the overall status of the GitHubIdentityProvider. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Conditions represents the observations of an identity provider's current state. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuborganizationsspec"]
|
|
==== GitHubOrganizationsSpec
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuballowauthenticationspec[$$GitHubAllowAuthenticationSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`policy`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githuballowedauthorganizationspolicy[$$GitHubAllowedAuthOrganizationsPolicy$$]__ | Policy must be set to "AllGitHubUsers" if allowed is empty. +
|
|
|
|
|
|
This field only exists to ensure that Pinniped administrators are aware that an empty list of +
|
|
allowedOrganizations means all GitHub users are allowed to log in. +
|
|
| *`allowed`* __string array__ | Allowed, when specified, indicates that only users with membership in at least one of the listed +
|
|
GitHub organizations may log in. In addition, the group membership presented to Kubernetes will only include +
|
|
teams within the listed GitHub organizations. Additional login rules or group filtering can optionally be +
|
|
provided as policy expression on any Pinniped Supervisor FederationDomain that includes this IDP. +
|
|
|
|
|
|
The configured GitHub App or GitHub OAuth App must be allowed to see membership in the listed organizations, +
|
|
otherwise Pinniped will not be aware that the user belongs to the listed organization or any teams +
|
|
within that organization. +
|
|
|
|
|
|
If no organizations are listed, you must set organizations: AllGitHubUsers. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubusernameattribute"]
|
|
==== GitHubUsernameAttribute (string)
|
|
|
|
GitHubUsernameAttribute allows the user to specify which attribute(s) from GitHub to use for the username to present
|
|
to Kubernetes. See the response schema for
|
|
[Get the authenticated user](https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-the-authenticated-user).
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubclaims[$$GitHubClaims$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovider"]
|
|
==== LDAPIdentityProvider
|
|
|
|
LDAPIdentityProvider describes the configuration of an upstream Lightweight Directory Access
|
|
Protocol (LDAP) identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderlist[$$LDAPIdentityProviderList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderstatus[$$LDAPIdentityProviderStatus$$]__ | Status of the identity provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderbind"]
|
|
==== LDAPIdentityProviderBind
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the username and +
|
|
password for an LDAP bind user. This account will be used to perform LDAP searches. The Secret should be +
|
|
of type "kubernetes.io/basic-auth" which includes "username" and "password" keys. The username value +
|
|
should be the full dn (distinguished name) of your bind account, e.g. "cn=bind-account,ou=users,dc=example,dc=com". +
|
|
The password must be non-empty. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovidergroupsearch"]
|
|
==== LDAPIdentityProviderGroupSearch
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g. +
|
|
"ou=groups,dc=example,dc=com". When not specified, no group search will be performed and +
|
|
authenticated users will not belong to any groups from the LDAP provider. Also, when not specified, +
|
|
the values of Filter, UserAttributeForFilter, Attributes, and SkipGroupRefresh are ignored. +
|
|
| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for groups for a user. +
|
|
The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the +
|
|
value of an attribute of the user entry found as a result of the user search. Which attribute's +
|
|
value is used to replace the placeholder(s) depends on the value of UserAttributeForFilter. +
|
|
For more information about LDAP filters, see https://ldap.com/ldap-filters. +
|
|
Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. +
|
|
Optional. When not specified, the default will act as if the Filter were specified as "member={}". +
|
|
| *`userAttributeForFilter`* __string__ | UserAttributeForFilter specifies which attribute's value from the user entry found as a result of +
|
|
the user search will be used to replace the "{}" placeholder(s) in the group search Filter. +
|
|
For example, specifying "uid" as the UserAttributeForFilter while specifying +
|
|
"&(objectClass=posixGroup)(memberUid={})" as the Filter would search for groups by replacing +
|
|
the "{}" placeholder in the Filter with the value of the user's "uid" attribute. +
|
|
Optional. When not specified, the default will act as if "dn" were specified. For example, leaving +
|
|
UserAttributeForFilter unspecified while specifying "&(objectClass=groupOfNames)(member={})" as the Filter +
|
|
would search for groups by replacing the "{}" placeholder(s) with the dn (distinguished name) of the user. +
|
|
| *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovidergroupsearchattributes[$$LDAPIdentityProviderGroupSearchAttributes$$]__ | Attributes specifies how the group's information should be read from each LDAP entry which was found as +
|
|
the result of the group search. +
|
|
| *`skipGroupRefresh`* __boolean__ | The user's group membership is refreshed as they interact with the supervisor +
|
|
to obtain new credentials (as their old credentials expire). This allows group +
|
|
membership changes to be quickly reflected into Kubernetes clusters. Since +
|
|
group membership is often used to bind authorization policies, it is important +
|
|
to keep the groups observed in Kubernetes clusters in-sync with the identity +
|
|
provider. +
|
|
|
|
|
|
In some environments, frequent group membership queries may result in a +
|
|
significant performance impact on the identity provider and/or the supervisor. +
|
|
The best approach to handle performance impacts is to tweak the group query +
|
|
to be more performant, for example by disabling nested group search or by +
|
|
using a more targeted group search base. +
|
|
|
|
|
|
If the group search query cannot be made performant and you are willing to +
|
|
have group memberships remain static for approximately a day, then set +
|
|
skipGroupRefresh to true. This is an insecure configuration as authorization +
|
|
policies that are bound to group membership will not notice if a user has +
|
|
been removed from a particular group until their next login. +
|
|
|
|
|
|
This is an experimental feature that may be removed or significantly altered +
|
|
in the future. Consumers of this configuration should carefully read all +
|
|
release notes before upgrading to ensure that the meaning of this field has +
|
|
not changed. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovidergroupsearchattributes"]
|
|
==== LDAPIdentityProviderGroupSearchAttributes
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovidergroupsearch[$$LDAPIdentityProviderGroupSearch$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`groupName`* __string__ | GroupName specifies the name of the attribute in the LDAP entries whose value shall become a group name +
|
|
in the user's list of groups after a successful authentication. +
|
|
The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP +
|
|
server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn". +
|
|
Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name). +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderphase"]
|
|
==== LDAPIdentityProviderPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderstatus[$$LDAPIdentityProviderStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec"]
|
|
==== LDAPIdentityProviderSpec
|
|
|
|
Spec for configuring an LDAP identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovider[$$LDAPIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`host`* __string__ | Host is the hostname of this LDAP identity provider, i.e., where to connect. For example: ldap.example.com:636. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS contains the connection settings for how to establish the connection to the Host. +
|
|
| *`bind`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderbind[$$LDAPIdentityProviderBind$$]__ | Bind contains the configuration for how to provide access credentials during an initial bind to the LDAP server +
|
|
to be allowed to perform searches and binds to validate a user's credentials during a user's authentication attempt. +
|
|
| *`userSearch`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearch[$$LDAPIdentityProviderUserSearch$$]__ | UserSearch contains the configuration for searching for a user by name in the LDAP provider. +
|
|
| *`groupSearch`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovidergroupsearch[$$LDAPIdentityProviderGroupSearch$$]__ | GroupSearch contains the configuration for searching for a user's group membership in the LDAP provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderstatus"]
|
|
==== LDAPIdentityProviderStatus
|
|
|
|
Status of an LDAP identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityprovider[$$LDAPIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderphase[$$LDAPIdentityProviderPhase$$]__ | Phase summarizes the overall status of the LDAPIdentityProvider. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Represents the observations of an identity provider's current state. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearch"]
|
|
==== LDAPIdentityProviderUserSearch
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`base`* __string__ | Base is the dn (distinguished name) that should be used as the search base when searching for users. +
|
|
E.g. "ou=users,dc=example,dc=com". +
|
|
| *`filter`* __string__ | Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur +
|
|
in the filter at least once and will be dynamically replaced by the username for which the search is being run. +
|
|
E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see +
|
|
https://ldap.com/ldap-filters. +
|
|
Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used. +
|
|
Optional. When not specified, the default will act as if the Filter were specified as the value from +
|
|
Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be +
|
|
explicitly specified, since the default value of "dn={}" would not work. +
|
|
| *`attributes`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributes[$$LDAPIdentityProviderUserSearchAttributes$$]__ | Attributes specifies how the user's information should be read from the LDAP entry which was found as +
|
|
the result of the user search. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearchattributes"]
|
|
==== LDAPIdentityProviderUserSearchAttributes
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderusersearch[$$LDAPIdentityProviderUserSearch$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`username`* __string__ | Username specifies the name of the attribute in the LDAP entry whose value shall become the username +
|
|
of the user after a successful authentication. This would typically be the same attribute name used in +
|
|
the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName". +
|
|
The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP +
|
|
server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field +
|
|
is set to "dn" then the LDAPIdentityProviderUserSearch's Filter field cannot be blank, since the default +
|
|
value of "dn={}" would not work. +
|
|
| *`uid`* __string__ | UID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely +
|
|
identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID". +
|
|
The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP +
|
|
server in the user's entry. Distinguished names can be used by specifying lower-case "dn". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcauthorizationconfig"]
|
|
==== OIDCAuthorizationConfig
|
|
|
|
OIDCAuthorizationConfig provides information about how to form the OAuth2 authorization
|
|
request parameters.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`additionalScopes`* __string array__ | additionalScopes are the additional scopes that will be requested from your OIDC provider in the authorization +
|
|
request during an OIDC Authorization Code Flow and in the token request during a Resource Owner Password Credentials +
|
|
Grant. Note that the "openid" scope will always be requested regardless of the value in this setting, since it is +
|
|
always required according to the OIDC spec. By default, when this field is not set, the Supervisor will request +
|
|
the following scopes: "openid", "offline_access", "email", and "profile". See +
|
|
https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims for a description of the "profile" and "email" +
|
|
scopes. See https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess for a description of the +
|
|
"offline_access" scope. This default value may change in future versions of Pinniped as the standard evolves, +
|
|
or as common patterns used by providers who implement the standard in the ecosystem evolve. +
|
|
By setting this list to anything other than an empty list, you are overriding the +
|
|
default value, so you may wish to include some of "offline_access", "email", and "profile" in your override list. +
|
|
If you do not want any of these scopes to be requested, you may set this list to contain only "openid". +
|
|
Some OIDC providers may also require a scope to get access to the user's group membership, in which case you +
|
|
may wish to include it in this list. Sometimes the scope to request the user's group membership is called +
|
|
"groups", but unfortunately this is not specified in the OIDC standard. +
|
|
Generally speaking, you should include any scopes required to cause the appropriate claims to be the returned by +
|
|
your OIDC provider in the ID token or userinfo endpoint results for those claims which you would like to use in +
|
|
the oidcClaims settings to determine the usernames and group memberships of your Kubernetes users. See +
|
|
your OIDC provider's documentation for more information about what scopes are available to request claims. +
|
|
Additionally, the Pinniped Supervisor requires that your OIDC provider returns refresh tokens to the Supervisor +
|
|
from these authorization flows. For most OIDC providers, the scope required to receive refresh tokens will be +
|
|
"offline_access". See the documentation of your OIDC provider's authorization and token endpoints for its +
|
|
requirements for what to include in the request in order to receive a refresh token in the response, if anything. +
|
|
Note that it may be safe to send "offline_access" even to providers which do not require it, since the provider +
|
|
may ignore scopes that it does not understand or require (see +
|
|
https://datatracker.ietf.org/doc/html/rfc6749#section-3.3). In the unusual case that you must avoid sending the +
|
|
"offline_access" scope, then you must override the default value of this setting. This is required if your OIDC +
|
|
provider will reject the request when it includes "offline_access" (e.g. GitLab's OIDC provider). +
|
|
| *`additionalAuthorizeParameters`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-parameter[$$Parameter$$] array__ | additionalAuthorizeParameters are extra query parameters that should be included in the authorize request to your +
|
|
OIDC provider in the authorization request during an OIDC Authorization Code Flow. By default, no extra +
|
|
parameters are sent. The standard parameters that will be sent are "response_type", "scope", "client_id", +
|
|
"state", "nonce", "code_challenge", "code_challenge_method", and "redirect_uri". These parameters cannot be +
|
|
included in this setting. Additionally, the "hd" parameter cannot be included in this setting at this time. +
|
|
The "hd" parameter is used by Google's OIDC provider to provide a hint as to which "hosted domain" the user +
|
|
should use during login. However, Pinniped does not yet support validating the hosted domain in the resulting +
|
|
ID token, so it is not yet safe to use this feature of Google's OIDC provider with Pinniped. +
|
|
This setting does not influence the parameters sent to the token endpoint in the Resource Owner Password +
|
|
Credentials Grant. The Pinniped Supervisor requires that your OIDC provider returns refresh tokens to the +
|
|
Supervisor from the authorization flows. Some OIDC providers may require a certain value for the "prompt" +
|
|
parameter in order to properly request refresh tokens. See the documentation of your OIDC provider's +
|
|
authorization endpoint for its requirements for what to include in the request in order to receive a refresh +
|
|
token in the response, if anything. If your provider requires the prompt parameter to request a refresh token, +
|
|
then include it here. Also note that most providers also require a certain scope to be requested in order to +
|
|
receive refresh tokens. See the additionalScopes setting for more information about using scopes to request +
|
|
refresh tokens. +
|
|
| *`allowPasswordGrant`* __boolean__ | allowPasswordGrant, when true, will allow the use of OAuth 2.0's Resource Owner Password Credentials Grant +
|
|
(see https://datatracker.ietf.org/doc/html/rfc6749#section-4.3) to authenticate to the OIDC provider using a +
|
|
username and password without a web browser, in addition to the usual browser-based OIDC Authorization Code Flow. +
|
|
The Resource Owner Password Credentials Grant is not officially part of the OIDC specification, so it may not be +
|
|
supported by your OIDC provider. If your OIDC provider supports returning ID tokens from a Resource Owner Password +
|
|
Credentials Grant token request, then you can choose to set this field to true. This will allow end users to choose +
|
|
to present their username and password to the kubectl CLI (using the Pinniped plugin) to authenticate to the +
|
|
cluster, without using a web browser to log in as is customary in OIDC Authorization Code Flow. This may be +
|
|
convenient for users, especially for identities from your OIDC provider which are not intended to represent a human +
|
|
actor, such as service accounts performing actions in a CI/CD environment. Even if your OIDC provider supports it, +
|
|
you may wish to disable this behavior by setting this field to false when you prefer to only allow users of this +
|
|
OIDCIdentityProvider to log in via the browser-based OIDC Authorization Code Flow. Using the Resource Owner Password +
|
|
Credentials Grant means that the Pinniped CLI and Pinniped Supervisor will directly handle your end users' passwords +
|
|
(similar to LDAPIdentityProvider), and you will not be able to require multi-factor authentication or use the other +
|
|
web-based login features of your OIDC provider during Resource Owner Password Credentials Grant logins. +
|
|
allowPasswordGrant defaults to false. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcclaims"]
|
|
==== OIDCClaims
|
|
|
|
OIDCClaims provides a mapping from upstream claims into identities.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`groups`* __string__ | Groups provides the name of the ID token claim or userinfo endpoint response claim that will be used to ascertain +
|
|
the groups to which an identity belongs. By default, the identities will not include any group memberships when +
|
|
this setting is not configured. +
|
|
| *`username`* __string__ | Username provides the name of the ID token claim or userinfo endpoint response claim that will be used to +
|
|
ascertain an identity's username. When not set, the username will be an automatically constructed unique string +
|
|
which will include the issuer URL of your OIDC provider along with the value of the "sub" (subject) claim from +
|
|
the ID token. +
|
|
| *`additionalClaimMappings`* __object (keys:string, values:string)__ | AdditionalClaimMappings allows for additional arbitrary upstream claim values to be mapped into the +
|
|
"additionalClaims" claim of the ID tokens generated by the Supervisor. This should be specified as a map of +
|
|
new claim names as the keys, and upstream claim names as the values. These new claim names will be nested +
|
|
under the top-level "additionalClaims" claim in ID tokens generated by the Supervisor when this +
|
|
OIDCIdentityProvider was used for user authentication. These claims will be made available to all clients. +
|
|
This feature is not required to use the Supervisor to provide authentication for Kubernetes clusters, but can be +
|
|
used when using the Supervisor for other authentication purposes. When this map is empty or the upstream claims +
|
|
are not available, the "additionalClaims" claim will be excluded from the ID tokens generated by the Supervisor. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcclient"]
|
|
==== OIDCClient
|
|
|
|
OIDCClient contains information about an OIDC client (e.g., client ID and client
|
|
secret).
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`secretName`* __string__ | SecretName contains the name of a namespace-local Secret object that provides the clientID and +
|
|
clientSecret for an OIDC client. If only the SecretName is specified in an OIDCClient +
|
|
struct, then it is expected that the Secret is of type "secrets.pinniped.dev/oidc-client" with keys +
|
|
"clientID" and "clientSecret". +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityprovider"]
|
|
==== OIDCIdentityProvider
|
|
|
|
OIDCIdentityProvider describes the configuration of an upstream OpenID Connect identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderlist[$$OIDCIdentityProviderList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]__ | Spec for configuring the identity provider. +
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus[$$OIDCIdentityProviderStatus$$]__ | Status of the identity provider. +
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderphase"]
|
|
==== OIDCIdentityProviderPhase (string)
|
|
|
|
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus[$$OIDCIdentityProviderStatus$$]
|
|
****
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec"]
|
|
==== OIDCIdentityProviderSpec
|
|
|
|
OIDCIdentityProviderSpec is the spec for configuring an OIDC identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityprovider[$$OIDCIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`issuer`* __string__ | Issuer is the issuer URL of this OIDC identity provider, i.e., where to fetch +
|
|
/.well-known/openid-configuration. +
|
|
| *`tls`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec[$$TLSSpec$$]__ | TLS configuration for discovery/JWKS requests to the issuer. +
|
|
| *`authorizationConfig`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcauthorizationconfig[$$OIDCAuthorizationConfig$$]__ | AuthorizationConfig holds information about how to form the OAuth2 authorization request +
|
|
parameters to be used with this OIDC identity provider. +
|
|
| *`claims`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcclaims[$$OIDCClaims$$]__ | Claims provides the names of token claims that will be used when inspecting an identity from +
|
|
this OIDC identity provider. +
|
|
| *`client`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcclient[$$OIDCClient$$]__ | OIDCClient contains OIDC client information to be used used with this OIDC identity +
|
|
provider. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderstatus"]
|
|
==== OIDCIdentityProviderStatus
|
|
|
|
OIDCIdentityProviderStatus is the status of an OIDC identity provider.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityprovider[$$OIDCIdentityProvider$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`phase`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderphase[$$OIDCIdentityProviderPhase$$]__ | Phase summarizes the overall status of the OIDCIdentityProvider. +
|
|
| *`conditions`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta[$$Condition$$] array__ | Represents the observations of an identity provider's current state. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-parameter"]
|
|
==== Parameter
|
|
|
|
Parameter is a key/value pair which represents a parameter in an HTTP request.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcauthorizationconfig[$$OIDCAuthorizationConfig$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`name`* __string__ | The name of the parameter. Required. +
|
|
| *`value`* __string__ | The value of the parameter. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-tlsspec"]
|
|
==== TLSSpec
|
|
|
|
TLSSpec provides TLS configuration for identity provider integration.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-activedirectoryidentityproviderspec[$$ActiveDirectoryIdentityProviderSpec$$]
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-githubapiconfig[$$GitHubAPIConfig$$]
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-ldapidentityproviderspec[$$LDAPIdentityProviderSpec$$]
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-oidcidentityproviderspec[$$OIDCIdentityProviderSpec$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`certificateAuthorityData`* __string__ | X.509 Certificate Authority (base64-encoded PEM bundle). If omitted, a default set of system roots will be trusted. +
|
|
| *`certificateAuthorityDataSource`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-supervisor-idp-v1alpha1-cabundlesource[$$CABundleSource$$]__ | Reference to a CA bundle in a secret or a configmap. +
|
|
|===
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-login-concierge-pinniped-dev-v1alpha1"]
|
|
=== login.concierge.pinniped.dev/v1alpha1
|
|
|
|
Package v1alpha1 is the v1alpha1 version of the Pinniped login API.
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-clustercredential"]
|
|
==== ClusterCredential
|
|
|
|
ClusterCredential is the cluster-specific credential returned on a successful credential request. It
|
|
contains either a valid bearer token or a valid TLS certificate and corresponding private key for the cluster.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequeststatus[$$TokenCredentialRequestStatus$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`expirationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#time-v1-meta[$$Time$$]__ | ExpirationTimestamp indicates a time when the provided credentials expire. +
|
|
| *`token`* __string__ | Token is a bearer token used by the client for request authentication. +
|
|
| *`clientCertificateData`* __string__ | PEM-encoded client TLS certificates (including intermediates, if any). +
|
|
| *`clientKeyData`* __string__ | PEM-encoded private key for the above certificate. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequest"]
|
|
==== TokenCredentialRequest
|
|
|
|
TokenCredentialRequest submits an IDP-specific credential to Pinniped in exchange for a cluster-specific credential.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequestlist[$$TokenCredentialRequestList$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`metadata`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta[$$ObjectMeta$$]__ | Refer to Kubernetes API documentation for fields of `metadata`.
|
|
|
|
| *`spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequestspec[$$TokenCredentialRequestSpec$$]__ |
|
|
| *`status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequeststatus[$$TokenCredentialRequestStatus$$]__ |
|
|
|===
|
|
|
|
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequestspec"]
|
|
==== TokenCredentialRequestSpec
|
|
|
|
Specification of a TokenCredentialRequest, expected on requests to the Pinniped API.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequest[$$TokenCredentialRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`token`* __string__ | Bearer token supplied with the credential request. +
|
|
| *`authenticator`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#typedlocalobjectreference-v1-core[$$TypedLocalObjectReference$$]__ | Reference to an authenticator which can validate this credential request. +
|
|
|===
|
|
|
|
|
|
[id="{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequeststatus"]
|
|
==== TokenCredentialRequestStatus
|
|
|
|
Status of a TokenCredentialRequest, returned on responses to the Pinniped API.
|
|
|
|
.Appears In:
|
|
****
|
|
- xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-tokencredentialrequest[$$TokenCredentialRequest$$]
|
|
****
|
|
|
|
[cols="25a,75a", options="header"]
|
|
|===
|
|
| Field | Description
|
|
| *`credential`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-30-apis-concierge-login-v1alpha1-clustercredential[$$ClusterCredential$$]__ | A Credential will be returned for a successful credential request. +
|
|
| *`message`* __string__ | An error message will be returned for an unsuccessful credential request. +
|
|
|===
|
|
|
|
|