kubernetes

Import a full cluster authentication configuration

Replaces the entire set of OIDC authentication issuer configurations for a cluster with the supplied native kube-apiserver v1 AuthenticationConfiguration YAML document. Issuers are named deterministically from their issuer URL host. The top-level anonymous field is not supported and any configuration that would drop data is rejected.

put/1.3/kubernetes/{uuid}/authentication/import

Request

  • Base URL: https://api.upcloud.com
  • URL: https://api.upcloud.com/1.3/kubernetes/{uuid}/authentication/import
  • Auth: HTTP bearer

Path parameters

uuidstring uuid required

UUID

Response

Authentication configuration imported.

namestring required

Name

issuer_urlstring uri required
discovery_urlstring uri
audiencesstring[] required

Accepted audiences for tokens from this issuer. The first audience is used as the OIDC client id in generated kubeconfigs by default; the OIDC kubeconfig endpoint's audience query parameter can select a different one.

audience_match_policy'MatchAny' | ''
certificate_authoritystring

Base64-encoded PEM certificate authority bundle.

Example response

[
  {
    "issuer_url": "https://accounts.myoidcprovider.com",
    "discovery_url": "https://accounts.myoidcprovider.com/.well-known/openid-configuration",
    "audiences": [
      "client-id-123"
    ],
    "claim_mappings": {
      "username": {
        "claim": "email",
        "prefix": "oidc:",
        "expression": "claims.email"
      },
      "groups": {
        "claim": "email",
        "prefix": "oidc:",
        "expression": "claims.email"
      },
      "uid": {
        "claim": "sub",
        "expression": "claims.sub"
      },
      "extra": [
        {
          "key": "example.org/foo",
          "value_expression": "claims.some_claim"
        }
      ]
    },
    "claim_validation_rules": [
      {
        "claim": "hd",
        "required_value": "upcloud.com",
        "expression": "claims.hd == 'upcloud.com'",
        "message": "User must belong to the upcloud.com organization domain."
      }
    ],
    "user_validation_rules": [
      {
        "expression": "!user.username.startsWith('system:')",
        "message": "Username must not start with the system: prefix."
      }
    ]
  }
]

Changes

No recorded changes to this operation across all 1 revision of this API.