kubernetes

Update a cluster authentication entry

Updates an existing OIDC authentication issuer configuration. The name in the path is authoritative. The updated entry is validated together with the cluster's other entries before being applied.

put/1.3/kubernetes/{uuid}/authentication/{name}

Request

  • Base URL: https://api.upcloud.com
  • URL: https://api.upcloud.com/1.3/kubernetes/{uuid}/authentication/{name}
  • Auth: HTTP bearer

Path parameters

uuidstring uuid required

UUID

namestring required

Name

Request body

namestring required

Name

issuer_urlstring uri required
discovery_urlstring uri
audiencesstring[] required

Accepted audiences for tokens from this issuer. The first audience is used as the OIDC client id in generated kubeconfigs by default; the OIDC kubeconfig endpoint's audience query parameter can select a different one.

audience_match_policy'MatchAny' | ''
certificate_authoritystring

Base64-encoded PEM certificate authority bundle.

Example request

{
  "issuer_url": "https://accounts.myoidcprovider.com",
  "discovery_url": "https://accounts.myoidcprovider.com/.well-known/openid-configuration",
  "audiences": [
    "client-id-123"
  ],
  "claim_mappings": {
    "username": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "groups": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "uid": {
      "claim": "sub",
      "expression": "claims.sub"
    },
    "extra": [
      {
        "key": "example.org/foo",
        "value_expression": "claims.some_claim"
      }
    ]
  },
  "claim_validation_rules": [
    {
      "claim": "hd",
      "required_value": "upcloud.com",
      "expression": "claims.hd == 'upcloud.com'",
      "message": "User must belong to the upcloud.com organization domain."
    }
  ],
  "user_validation_rules": [
    {
      "expression": "!user.username.startsWith('system:')",
      "message": "Username must not start with the system: prefix."
    }
  ]
}

Response

Authentication entry updated.

namestring required

Name

issuer_urlstring uri required
discovery_urlstring uri
audiencesstring[] required

Accepted audiences for tokens from this issuer. The first audience is used as the OIDC client id in generated kubeconfigs by default; the OIDC kubeconfig endpoint's audience query parameter can select a different one.

audience_match_policy'MatchAny' | ''
certificate_authoritystring

Base64-encoded PEM certificate authority bundle.

Example response

{
  "issuer_url": "https://accounts.myoidcprovider.com",
  "discovery_url": "https://accounts.myoidcprovider.com/.well-known/openid-configuration",
  "audiences": [
    "client-id-123"
  ],
  "claim_mappings": {
    "username": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "groups": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "uid": {
      "claim": "sub",
      "expression": "claims.sub"
    },
    "extra": [
      {
        "key": "example.org/foo",
        "value_expression": "claims.some_claim"
      }
    ]
  },
  "claim_validation_rules": [
    {
      "claim": "hd",
      "required_value": "upcloud.com",
      "expression": "claims.hd == 'upcloud.com'",
      "message": "User must belong to the upcloud.com organization domain."
    }
  ],
  "user_validation_rules": [
    {
      "expression": "!user.username.startsWith('system:')",
      "message": "Username must not start with the system: prefix."
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.