kubernetes

Create a cluster authentication entry

Creates a new OIDC authentication issuer configuration. The new entry is validated together with the cluster's existing entries before being applied. Fails if an entry with the same name already exists.

uuidstring uuid required

UUID

Request body

namestring required

Name

issuer_urlstring uri required

discovery_urlstring uri

audiencesstring[] required

Accepted audiences for tokens from this issuer. The first audience is used as the OIDC client id in generated kubeconfigs by default; the OIDC kubeconfig endpoint's audience query parameter can select a different one.

audience_match_policy'MatchAny' | ''

certificate_authoritystring

Base64-encoded PEM certificate authority bundle.

Example request

{
  "issuer_url": "https://accounts.myoidcprovider.com",
  "discovery_url": "https://accounts.myoidcprovider.com/.well-known/openid-configuration",
  "audiences": [
    "client-id-123"
  ],
  "claim_mappings": {
    "username": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "groups": {
      "claim": "email",
      "prefix": "oidc:",
      "expression": "claims.email"
    },
    "uid": {
      "claim": "sub",
      "expression": "claims.sub"
    },
    "extra": [
      {
        "key": "example.org/foo",
        "value_expression": "claims.some_claim"
      }
    ]
  },
  "claim_validation_rules": [
    {
      "claim": "hd",
      "required_value": "upcloud.com",
      "expression": "claims.hd == 'upcloud.com'",
      "message": "User must belong to the upcloud.com organization domain."
    }
  ],
  "user_validation_rules": [
    {
      "expression": "!user.username.startsWith('system:')",
      "message": "Username must not start with the system: prefix."
    }
  ]
}

Response

Authentication entry created.