460 lines
16 KiB
JSON
460 lines
16 KiB
JSON
{
|
|
"description": "AccessControlPolicy defines an access control policy.",
|
|
"properties": {
|
|
"apiVersion": {
|
|
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
|
|
"type": "string"
|
|
},
|
|
"kind": {
|
|
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
|
|
"type": "string"
|
|
},
|
|
"metadata": {
|
|
"type": "object"
|
|
},
|
|
"spec": {
|
|
"description": "AccessControlPolicySpec configures an access control policy.",
|
|
"properties": {
|
|
"apiKey": {
|
|
"description": "AccessControlPolicyAPIKey configure an APIKey control policy.",
|
|
"properties": {
|
|
"forwardHeaders": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.",
|
|
"type": "object"
|
|
},
|
|
"keySource": {
|
|
"description": "KeySource defines how to extract API keys from requests.",
|
|
"properties": {
|
|
"cookie": {
|
|
"description": "Cookie is the name of a cookie.",
|
|
"type": "string"
|
|
},
|
|
"header": {
|
|
"description": "Header is the name of a header.",
|
|
"type": "string"
|
|
},
|
|
"headerAuthScheme": {
|
|
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
|
"type": "string"
|
|
},
|
|
"query": {
|
|
"description": "Query is the name of a query parameter.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"keys": {
|
|
"description": "Keys define the set of authorized keys to access a protected resource.",
|
|
"items": {
|
|
"description": "AccessControlPolicyAPIKeyKey defines an API key.",
|
|
"properties": {
|
|
"id": {
|
|
"description": "ID is the unique identifier of the key.",
|
|
"type": "string"
|
|
},
|
|
"metadata": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.",
|
|
"type": "object"
|
|
},
|
|
"value": {
|
|
"description": "Value is the SHAKE-256 hash (using 64 bytes) of the API key.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"id",
|
|
"value"
|
|
],
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"required": [
|
|
"keySource"
|
|
],
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"basicAuth": {
|
|
"description": "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.",
|
|
"properties": {
|
|
"forwardUsernameHeader": {
|
|
"type": "string"
|
|
},
|
|
"realm": {
|
|
"type": "string"
|
|
},
|
|
"stripAuthorizationHeader": {
|
|
"type": "boolean"
|
|
},
|
|
"users": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"jwt": {
|
|
"description": "AccessControlPolicyJWT configures a JWT access control policy.",
|
|
"properties": {
|
|
"claims": {
|
|
"type": "string"
|
|
},
|
|
"forwardHeaders": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"jwksFile": {
|
|
"type": "string"
|
|
},
|
|
"jwksUrl": {
|
|
"type": "string"
|
|
},
|
|
"publicKey": {
|
|
"type": "string"
|
|
},
|
|
"signingSecret": {
|
|
"type": "string"
|
|
},
|
|
"signingSecretBase64Encoded": {
|
|
"type": "boolean"
|
|
},
|
|
"stripAuthorizationHeader": {
|
|
"type": "boolean"
|
|
},
|
|
"tokenQueryKey": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"oAuthIntro": {
|
|
"description": "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.",
|
|
"properties": {
|
|
"claims": {
|
|
"type": "string"
|
|
},
|
|
"clientConfig": {
|
|
"description": "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.",
|
|
"properties": {
|
|
"headers": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"description": "Headers to set when sending requests to the Authorization Server.",
|
|
"type": "object"
|
|
},
|
|
"maxRetries": {
|
|
"default": 3,
|
|
"description": "MaxRetries defines the number of retries for introspection requests.",
|
|
"type": "integer"
|
|
},
|
|
"timeoutSeconds": {
|
|
"default": 5,
|
|
"description": "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.",
|
|
"type": "integer"
|
|
},
|
|
"tls": {
|
|
"description": "TLS configures TLS communication with the Authorization Server.",
|
|
"properties": {
|
|
"ca": {
|
|
"description": "CA sets the CA bundle used to sign the Authorization Server certificate.",
|
|
"type": "string"
|
|
},
|
|
"insecureSkipVerify": {
|
|
"description": "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.",
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"tokenTypeHint": {
|
|
"description": "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.",
|
|
"type": "string"
|
|
},
|
|
"url": {
|
|
"description": "URL of the Authorization Server.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"url"
|
|
],
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"forwardHeaders": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"tokenSource": {
|
|
"description": "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.",
|
|
"properties": {
|
|
"cookie": {
|
|
"description": "Cookie is the name of a cookie.",
|
|
"type": "string"
|
|
},
|
|
"header": {
|
|
"description": "Header is the name of a header.",
|
|
"type": "string"
|
|
},
|
|
"headerAuthScheme": {
|
|
"description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
|
|
"type": "string"
|
|
},
|
|
"query": {
|
|
"description": "Query is the name of a query parameter.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"required": [
|
|
"clientConfig",
|
|
"tokenSource"
|
|
],
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"oidc": {
|
|
"description": "AccessControlPolicyOIDC holds the OIDC authentication configuration.",
|
|
"properties": {
|
|
"authParams": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"claims": {
|
|
"type": "string"
|
|
},
|
|
"clientId": {
|
|
"type": "string"
|
|
},
|
|
"disableAuthRedirectionPaths": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"forwardHeaders": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"issuer": {
|
|
"type": "string"
|
|
},
|
|
"logoutUrl": {
|
|
"type": "string"
|
|
},
|
|
"redirectUrl": {
|
|
"type": "string"
|
|
},
|
|
"scopes": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"secret": {
|
|
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
|
"properties": {
|
|
"name": {
|
|
"description": "name is unique within a namespace to reference a secret resource.",
|
|
"type": "string"
|
|
},
|
|
"namespace": {
|
|
"description": "namespace defines the space within which the secret name must be unique.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"x-kubernetes-map-type": "atomic",
|
|
"additionalProperties": false
|
|
},
|
|
"session": {
|
|
"description": "Session holds session configuration.",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"refresh": {
|
|
"type": "boolean"
|
|
},
|
|
"sameSite": {
|
|
"type": "string"
|
|
},
|
|
"secure": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"stateCookie": {
|
|
"description": "StateCookie holds state cookie configuration.",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"sameSite": {
|
|
"type": "string"
|
|
},
|
|
"secure": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"oidcGoogle": {
|
|
"description": "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.",
|
|
"properties": {
|
|
"authParams": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"clientId": {
|
|
"type": "string"
|
|
},
|
|
"emails": {
|
|
"description": "Emails are the allowed emails to connect.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"minItems": 1,
|
|
"type": "array"
|
|
},
|
|
"forwardHeaders": {
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
},
|
|
"type": "object"
|
|
},
|
|
"logoutUrl": {
|
|
"type": "string"
|
|
},
|
|
"redirectUrl": {
|
|
"type": "string"
|
|
},
|
|
"secret": {
|
|
"description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
|
|
"properties": {
|
|
"name": {
|
|
"description": "name is unique within a namespace to reference a secret resource.",
|
|
"type": "string"
|
|
},
|
|
"namespace": {
|
|
"description": "namespace defines the space within which the secret name must be unique.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"x-kubernetes-map-type": "atomic",
|
|
"additionalProperties": false
|
|
},
|
|
"session": {
|
|
"description": "Session holds session configuration.",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"refresh": {
|
|
"type": "boolean"
|
|
},
|
|
"sameSite": {
|
|
"type": "string"
|
|
},
|
|
"secure": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"stateCookie": {
|
|
"description": "StateCookie holds state cookie configuration.",
|
|
"properties": {
|
|
"domain": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"sameSite": {
|
|
"type": "string"
|
|
},
|
|
"secure": {
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
},
|
|
"status": {
|
|
"description": "The current status of this access control policy.",
|
|
"properties": {
|
|
"specHash": {
|
|
"type": "string"
|
|
},
|
|
"syncedAt": {
|
|
"format": "date-time",
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|