Sign in
Kubernetes Auth

Update Kubernetes Auth configuration on machine identity

patch/api/v1/auth/kubernetes-auth/identities/{identityId}

Path parameters

identityIdstring required

The ID of the machine identity to update the auth method for.

Request body

templateIdstring uuid nullable

The ID of the Kubernetes auth template to link. While linked, connection settings are managed by the template and cannot be set individually. Pass null to unlink the template; the settings copied from it are kept.

kubernetesHoststring nullable

The new host string, host:port pair, or URL to the base of the Kubernetes API server.

caCertstring

The new PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Required when verifyTlsCertificate is true. Supplying a non-empty caCert always implies verifyTlsCertificate=true; the update is rejected if the resulting effective state would store a CA together with verifyTlsCertificate=false.

verifyTlsCertificateboolean

Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate. When true, caCert is required. When false, the connection is still over HTTPS but the API server's certificate is not verified, and the resulting effective CA must be empty. If omitted while supplying a non-empty caCert in the same update, the toggle is auto-promoted to true; otherwise the stored value is preserved.

tokenReviewerJwtstring nullable

Optional JWT token for accessing Kubernetes TokenReview API. If provided, this long-lived token will be used to validate service account tokens during authentication. If omitted, the client's own JWT will be used instead, which requires the client to have the system:auth-delegator ClusterRole binding.

tokenReviewMode'api' | 'gateway'

The mode to use for token review. Must be one of: 'api', 'gateway'. If gateway is selected, the gateway must be deployed in Kubernetes, and the gateway must have the system:auth-delegator ClusterRole binding.

allowedNamespacesstring

The new comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.

allowedNamesstring

The new comma-separated list of trusted service account names that can authenticate with Infisical.

allowedAudiencestring

The new optional audience claim that the service account JWT token must have to authenticate with Infisical.

gatewayIdstring uuid nullable

The ID of the gateway to use when performing kubernetes API requests.

gatewayPoolIdstring uuid nullable
accessTokenTTLinteger

The new lifetime for an acccess token in seconds.

accessTokenNumUsesLimitinteger

The new maximum number of times that an access token can be used.

accessTokenMaxTTLinteger

The new maximum lifetime for an acccess token in seconds.

Response

Default Response

Changes

Changed in 1 of the 20 revisions of this API.23

  • 763e38e7833723See the full diff
    • ●

      the allowedAudience request property's maxLength was set to 1000

      request-property-max-length-set

    • ●

      the kubernetesHost request property's maxLength was set to 255

      request-property-max-length-set

    • ○

      added the new optional request property templateId

      new-optional-request-property

    • ○

      added the optional property identityKubernetesAuth/isTokenReviewerJwtTemplateSourced to the response with the 200 status

      response-optional-property-added

    • ○

      added the optional property identityKubernetesAuth/templateId to the response with the 200 status

      response-optional-property-added