first commit
This commit is contained in:
@@ -0,0 +1,459 @@
|
||||
{
|
||||
"description": "AccessControlPolicy defines an access control policy.",
|
||||
"properties": {
|
||||
"apiVersion": {
|
||||
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
||||
"type": "string"
|
||||
},
|
||||
"kind": {
|
||||
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object"
|
||||
},
|
||||
"spec": {
|
||||
"description": "AccessControlPolicySpec configures an access control policy.",
|
||||
"properties": {
|
||||
"apiKey": {
|
||||
"description": "AccessControlPolicyAPIKey configure an APIKey control policy.",
|
||||
"properties": {
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.",
|
||||
"type": "object"
|
||||
},
|
||||
"keySource": {
|
||||
"description": "KeySource defines how to extract API keys from requests.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"keys": {
|
||||
"description": "Keys define the set of authorized keys to access a protected resource.",
|
||||
"items": {
|
||||
"description": "AccessControlPolicyAPIKeyKey defines an API key.",
|
||||
"properties": {
|
||||
"id": {
|
||||
"description": "ID is the unique identifier of the key.",
|
||||
"type": "string"
|
||||
},
|
||||
"metadata": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.",
|
||||
"type": "object"
|
||||
},
|
||||
"value": {
|
||||
"description": "Value is the SHAKE-256 hash (using 64 bytes) of the API key.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"id",
|
||||
"value"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"keySource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"basicAuth": {
|
||||
"description": "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.",
|
||||
"properties": {
|
||||
"forwardUsernameHeader": {
|
||||
"type": "string"
|
||||
},
|
||||
"realm": {
|
||||
"type": "string"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"users": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"jwt": {
|
||||
"description": "AccessControlPolicyJWT configures a JWT access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"jwksFile": {
|
||||
"type": "string"
|
||||
},
|
||||
"jwksUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"publicKey": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecret": {
|
||||
"type": "string"
|
||||
},
|
||||
"signingSecretBase64Encoded": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"stripAuthorizationHeader": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"tokenQueryKey": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oAuthIntro": {
|
||||
"description": "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.",
|
||||
"properties": {
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientConfig": {
|
||||
"description": "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.",
|
||||
"properties": {
|
||||
"headers": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "Headers to set when sending requests to the Authorization Server.",
|
||||
"type": "object"
|
||||
},
|
||||
"maxRetries": {
|
||||
"default": 3,
|
||||
"description": "MaxRetries defines the number of retries for introspection requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"timeoutSeconds": {
|
||||
"default": 5,
|
||||
"description": "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.",
|
||||
"type": "integer"
|
||||
},
|
||||
"tls": {
|
||||
"description": "TLS configures TLS communication with the Authorization Server.",
|
||||
"properties": {
|
||||
"ca": {
|
||||
"description": "CA sets the CA bundle used to sign the Authorization Server certificate.",
|
||||
"type": "string"
|
||||
},
|
||||
"insecureSkipVerify": {
|
||||
"description": "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.",
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"tokenTypeHint": {
|
||||
"description": "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.",
|
||||
"type": "string"
|
||||
},
|
||||
"url": {
|
||||
"description": "URL of the Authorization Server.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"url"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"tokenSource": {
|
||||
"description": "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.",
|
||||
"properties": {
|
||||
"cookie": {
|
||||
"description": "Cookie is the name of a cookie.",
|
||||
"type": "string"
|
||||
},
|
||||
"header": {
|
||||
"description": "Header is the name of a header.",
|
||||
"type": "string"
|
||||
},
|
||||
"headerAuthScheme": {
|
||||
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
||||
"type": "string"
|
||||
},
|
||||
"query": {
|
||||
"description": "Query is the name of a query parameter.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"clientConfig",
|
||||
"tokenSource"
|
||||
],
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidc": {
|
||||
"description": "AccessControlPolicyOIDC holds the OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"claims": {
|
||||
"type": "string"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"disableAuthRedirectionPaths": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"issuer": {
|
||||
"type": "string"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"scopes": {
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "array"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"oidcGoogle": {
|
||||
"description": "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.",
|
||||
"properties": {
|
||||
"authParams": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"clientId": {
|
||||
"type": "string"
|
||||
},
|
||||
"emails": {
|
||||
"description": "Emails are the allowed emails to connect.",
|
||||
"items": {
|
||||
"type": "string"
|
||||
},
|
||||
"minItems": 1,
|
||||
"type": "array"
|
||||
},
|
||||
"forwardHeaders": {
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
},
|
||||
"type": "object"
|
||||
},
|
||||
"logoutUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"redirectUrl": {
|
||||
"type": "string"
|
||||
},
|
||||
"secret": {
|
||||
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "name is unique within a namespace to reference a secret resource.",
|
||||
"type": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "namespace defines the space within which the secret name must be unique.",
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"x-kubernetes-map-type": "atomic",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"session": {
|
||||
"description": "Session holds session configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"refresh": {
|
||||
"type": "boolean"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"stateCookie": {
|
||||
"description": "StateCookie holds state cookie configuration.",
|
||||
"properties": {
|
||||
"domain": {
|
||||
"type": "string"
|
||||
},
|
||||
"path": {
|
||||
"type": "string"
|
||||
},
|
||||
"sameSite": {
|
||||
"type": "string"
|
||||
},
|
||||
"secure": {
|
||||
"type": "boolean"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
},
|
||||
"status": {
|
||||
"description": "The current status of this access control policy.",
|
||||
"properties": {
|
||||
"specHash": {
|
||||
"type": "string"
|
||||
},
|
||||
"syncedAt": {
|
||||
"format": "date-time",
|
||||
"type": "string"
|
||||
},
|
||||
"version": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"type": "object",
|
||||
"additionalProperties": false
|
||||
}
|
||||
},
|
||||
"type": "object"
|
||||
}
|
||||
Reference in New Issue
Block a user