diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml
deleted file mode 100644
index ea5c3252280..00000000000
--- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml
+++ /dev/null
@@ -1,575 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: Default
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index 6a4daafeccd..00000000000
--- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,726 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: DevPreviewNoUpgrade
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- extra:
- description: |-
- extra is an optional field for configuring the mappings
- used to construct the extra attribute for the cluster identity.
- When omitted, no extra attributes will be present on the cluster identity.
- key values for extra mappings must be unique.
- A maximum of 64 extra attribute mappings may be provided.
- items:
- description: |-
- ExtraMapping allows specifying a key and CEL expression
- to evaluate the keys' value. It is used to create additional
- mappings and attributes added to a cluster identity from
- a provided authentication token.
- properties:
- key:
- description: |-
- key is a required field that specifies the string
- to use as the extra attribute key.
-
- key must be a domain-prefix path (e.g 'example.org/foo').
- key must not exceed 510 characters in length.
- key must contain the '/' character, separating the domain and path characters.
- key must not be empty.
-
- The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
- It must not exceed 253 characters in length.
- It must start and end with an alphanumeric character.
- It must only contain lower case alphanumeric characters and '-' or '.'.
- It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
-
- The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
- alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
- It must not exceed 256 characters in length.
- maxLength: 510
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: key must contain the '/' character
- rule: self.contains('/')
- - message: the domain of the key must consist of only
- lower case alphanumeric characters, '-' or '.',
- and must start and end with an alphanumeric character
- rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
- - message: the domain of the key must not exceed 253
- characters in length
- rule: self.split('/', 2)[0].size() <= 253
- - message: the domain 'kubernetes.io' is reserved
- for Kubernetes use
- rule: self.split('/', 2)[0] != 'kubernetes.io'
- - message: the subdomains '*.kubernetes.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
- - message: the domain 'k8s.io' is reserved for Kubernetes
- use
- rule: self.split('/', 2)[0] != 'k8s.io'
- - message: the subdomains '*.k8s.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
- - message: the domain 'openshift.io' is reserved for
- OpenShift use
- rule: self.split('/', 2)[0] != 'openshift.io'
- - message: the subdomains '*.openshift.io' are reserved
- for OpenShift use
- rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
- - message: the path of the key must not be empty and
- must consist of at least one alphanumeric character,
- percent-encoded octets, apostrophe, '-', '.',
- '_', '~', '!', '$', '&', '(', ')', '*', '+', ',',
- ';', '=', and ':'
- rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
- - message: the path of the key must not exceed 256
- characters in length
- rule: self.split('/', 2)[1].size() <= 256
- valueExpression:
- description: |-
- valueExpression is a required field to specify the CEL expression to extract
- the extra attribute value from a JWT token's claims.
- valueExpression must produce a string or string array value.
- "", [], and null are treated as the extra mapping not being present.
- Empty string values within an array are filtered out.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- valueExpression must not exceed 4096 characters in length.
- valueExpression must not be empty.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - key
- - valueExpression
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- uid:
- description: |-
- uid is an optional field for configuring the claim mapping
- used to construct the uid for the cluster identity.
-
- When using uid.claim to specify the claim it must be a single string value.
- When using uid.expression the expression must result in a single string value.
-
- When omitted, this means the user has no opinion and the platform
- is left to choose a default, which is subject to change over time.
- The current default is to use the 'sub' claim.
- properties:
- claim:
- description: |-
- claim is an optional field for specifying the
- JWT token claim that is used in the mapping.
- The value of this claim will be assigned to
- the field in which this mapping is associated.
-
- Precisely one of claim or expression must be set.
- claim must not be specified when expression is set.
- When specified, claim must be at least 1 character in length
- and must not exceed 256 characters in length.
- maxLength: 256
- minLength: 1
- type: string
- expression:
- description: |-
- expression is an optional field for specifying a
- CEL expression that produces a string value from
- JWT token claims.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- Precisely one of claim or expression must be set.
- expression must not be specified when claim is set.
- When specified, expression must be at least 1 character in length
- and must not exceed 4096 characters in length.
- maxLength: 4096
- minLength: 1
- type: string
- type: object
- x-kubernetes-validations:
- - message: precisely one of claim or expression must be
- set
- rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index 0fcf1d3f2c4..00000000000
--- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,726 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: TechPreviewNoUpgrade
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- extra:
- description: |-
- extra is an optional field for configuring the mappings
- used to construct the extra attribute for the cluster identity.
- When omitted, no extra attributes will be present on the cluster identity.
- key values for extra mappings must be unique.
- A maximum of 64 extra attribute mappings may be provided.
- items:
- description: |-
- ExtraMapping allows specifying a key and CEL expression
- to evaluate the keys' value. It is used to create additional
- mappings and attributes added to a cluster identity from
- a provided authentication token.
- properties:
- key:
- description: |-
- key is a required field that specifies the string
- to use as the extra attribute key.
-
- key must be a domain-prefix path (e.g 'example.org/foo').
- key must not exceed 510 characters in length.
- key must contain the '/' character, separating the domain and path characters.
- key must not be empty.
-
- The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
- It must not exceed 253 characters in length.
- It must start and end with an alphanumeric character.
- It must only contain lower case alphanumeric characters and '-' or '.'.
- It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
-
- The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
- alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
- It must not exceed 256 characters in length.
- maxLength: 510
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: key must contain the '/' character
- rule: self.contains('/')
- - message: the domain of the key must consist of only
- lower case alphanumeric characters, '-' or '.',
- and must start and end with an alphanumeric character
- rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
- - message: the domain of the key must not exceed 253
- characters in length
- rule: self.split('/', 2)[0].size() <= 253
- - message: the domain 'kubernetes.io' is reserved
- for Kubernetes use
- rule: self.split('/', 2)[0] != 'kubernetes.io'
- - message: the subdomains '*.kubernetes.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
- - message: the domain 'k8s.io' is reserved for Kubernetes
- use
- rule: self.split('/', 2)[0] != 'k8s.io'
- - message: the subdomains '*.k8s.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
- - message: the domain 'openshift.io' is reserved for
- OpenShift use
- rule: self.split('/', 2)[0] != 'openshift.io'
- - message: the subdomains '*.openshift.io' are reserved
- for OpenShift use
- rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
- - message: the path of the key must not be empty and
- must consist of at least one alphanumeric character,
- percent-encoded octets, apostrophe, '-', '.',
- '_', '~', '!', '$', '&', '(', ')', '*', '+', ',',
- ';', '=', and ':'
- rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
- - message: the path of the key must not exceed 256
- characters in length
- rule: self.split('/', 2)[1].size() <= 256
- valueExpression:
- description: |-
- valueExpression is a required field to specify the CEL expression to extract
- the extra attribute value from a JWT token's claims.
- valueExpression must produce a string or string array value.
- "", [], and null are treated as the extra mapping not being present.
- Empty string values within an array are filtered out.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- valueExpression must not exceed 4096 characters in length.
- valueExpression must not be empty.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - key
- - valueExpression
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- uid:
- description: |-
- uid is an optional field for configuring the claim mapping
- used to construct the uid for the cluster identity.
-
- When using uid.claim to specify the claim it must be a single string value.
- When using uid.expression the expression must result in a single string value.
-
- When omitted, this means the user has no opinion and the platform
- is left to choose a default, which is subject to change over time.
- The current default is to use the 'sub' claim.
- properties:
- claim:
- description: |-
- claim is an optional field for specifying the
- JWT token claim that is used in the mapping.
- The value of this claim will be assigned to
- the field in which this mapping is associated.
-
- Precisely one of claim or expression must be set.
- claim must not be specified when expression is set.
- When specified, claim must be at least 1 character in length
- and must not exceed 256 characters in length.
- maxLength: 256
- minLength: 1
- type: string
- expression:
- description: |-
- expression is an optional field for specifying a
- CEL expression that produces a string value from
- JWT token claims.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- Precisely one of claim or expression must be set.
- expression must not be specified when claim is set.
- When specified, expression must be at least 1 character in length
- and must not exceed 4096 characters in length.
- maxLength: 4096
- minLength: 1
- type: string
- type: object
- x-kubernetes-validations:
- - message: precisely one of claim or expression must be
- set
- rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
similarity index 99%
rename from config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml
rename to config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
index db8b07e8dd2..d5240ad0944 100644
--- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml
+++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
@@ -6,7 +6,6 @@ metadata:
api.openshift.io/merged-by-featuregates: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: CustomNoUpgrade
name: authentications.config.openshift.io
spec:
group: config.openshift.io
diff --git a/features.md b/features.md
index 31cc87ea84f..8298f266a42 100644
--- a/features.md
+++ b/features.md
@@ -26,7 +26,6 @@
| DynamicResourceAllocation| | | Enabled | Enabled | Enabled | Enabled |
| EtcdBackendQuota| | | Enabled | Enabled | Enabled | Enabled |
| Example| | | Enabled | Enabled | Enabled | Enabled |
-| ExternalOIDCWithUIDAndExtraClaimMappings| | | Enabled | Enabled | Enabled | Enabled |
| GCPClusterHostedDNS| | | Enabled | Enabled | Enabled | Enabled |
| GCPCustomAPIEndpoints| | | Enabled | Enabled | Enabled | Enabled |
| HighlyAvailableArbiter| | | Enabled | Enabled | Enabled | Enabled |
@@ -63,6 +62,7 @@
| VolumeAttributesClass| | | Enabled | Enabled | Enabled | Enabled |
| VolumeGroupSnapshot| | | Enabled | Enabled | Enabled | Enabled |
| ExternalOIDC| Enabled | | Enabled | Enabled | Enabled | Enabled |
+| ExternalOIDCWithUIDAndExtraClaimMappings| Enabled | | Enabled | Enabled | Enabled | Enabled |
| AWSEFSDriverVolumeMetrics| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| AdditionalRoutingCapabilities| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| AdminNetworkPolicy| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
diff --git a/features/features.go b/features/features.go
index 7172fe6cb13..81e9e49992d 100644
--- a/features/features.go
+++ b/features/features.go
@@ -480,7 +480,7 @@ var (
productScope(ocpSpecific).
enhancementPR("https://github.com/openshift/enhancements/pull/1777").
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
- enableForClusterProfile(Hypershift, configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
+ enableForClusterProfile(Hypershift, configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade, configv1.Default).
mustRegister()
FeatureGateExample = newFeatureGate("Example").
diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml
deleted file mode 100644
index ea5c3252280..00000000000
--- a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml
+++ /dev/null
@@ -1,575 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: Default
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index 6a4daafeccd..00000000000
--- a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,726 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: DevPreviewNoUpgrade
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- extra:
- description: |-
- extra is an optional field for configuring the mappings
- used to construct the extra attribute for the cluster identity.
- When omitted, no extra attributes will be present on the cluster identity.
- key values for extra mappings must be unique.
- A maximum of 64 extra attribute mappings may be provided.
- items:
- description: |-
- ExtraMapping allows specifying a key and CEL expression
- to evaluate the keys' value. It is used to create additional
- mappings and attributes added to a cluster identity from
- a provided authentication token.
- properties:
- key:
- description: |-
- key is a required field that specifies the string
- to use as the extra attribute key.
-
- key must be a domain-prefix path (e.g 'example.org/foo').
- key must not exceed 510 characters in length.
- key must contain the '/' character, separating the domain and path characters.
- key must not be empty.
-
- The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
- It must not exceed 253 characters in length.
- It must start and end with an alphanumeric character.
- It must only contain lower case alphanumeric characters and '-' or '.'.
- It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
-
- The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
- alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
- It must not exceed 256 characters in length.
- maxLength: 510
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: key must contain the '/' character
- rule: self.contains('/')
- - message: the domain of the key must consist of only
- lower case alphanumeric characters, '-' or '.',
- and must start and end with an alphanumeric character
- rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
- - message: the domain of the key must not exceed 253
- characters in length
- rule: self.split('/', 2)[0].size() <= 253
- - message: the domain 'kubernetes.io' is reserved
- for Kubernetes use
- rule: self.split('/', 2)[0] != 'kubernetes.io'
- - message: the subdomains '*.kubernetes.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
- - message: the domain 'k8s.io' is reserved for Kubernetes
- use
- rule: self.split('/', 2)[0] != 'k8s.io'
- - message: the subdomains '*.k8s.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
- - message: the domain 'openshift.io' is reserved for
- OpenShift use
- rule: self.split('/', 2)[0] != 'openshift.io'
- - message: the subdomains '*.openshift.io' are reserved
- for OpenShift use
- rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
- - message: the path of the key must not be empty and
- must consist of at least one alphanumeric character,
- percent-encoded octets, apostrophe, '-', '.',
- '_', '~', '!', '$', '&', '(', ')', '*', '+', ',',
- ';', '=', and ':'
- rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
- - message: the path of the key must not exceed 256
- characters in length
- rule: self.split('/', 2)[1].size() <= 256
- valueExpression:
- description: |-
- valueExpression is a required field to specify the CEL expression to extract
- the extra attribute value from a JWT token's claims.
- valueExpression must produce a string or string array value.
- "", [], and null are treated as the extra mapping not being present.
- Empty string values within an array are filtered out.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- valueExpression must not exceed 4096 characters in length.
- valueExpression must not be empty.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - key
- - valueExpression
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- uid:
- description: |-
- uid is an optional field for configuring the claim mapping
- used to construct the uid for the cluster identity.
-
- When using uid.claim to specify the claim it must be a single string value.
- When using uid.expression the expression must result in a single string value.
-
- When omitted, this means the user has no opinion and the platform
- is left to choose a default, which is subject to change over time.
- The current default is to use the 'sub' claim.
- properties:
- claim:
- description: |-
- claim is an optional field for specifying the
- JWT token claim that is used in the mapping.
- The value of this claim will be assigned to
- the field in which this mapping is associated.
-
- Precisely one of claim or expression must be set.
- claim must not be specified when expression is set.
- When specified, claim must be at least 1 character in length
- and must not exceed 256 characters in length.
- maxLength: 256
- minLength: 1
- type: string
- expression:
- description: |-
- expression is an optional field for specifying a
- CEL expression that produces a string value from
- JWT token claims.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- Precisely one of claim or expression must be set.
- expression must not be specified when claim is set.
- When specified, expression must be at least 1 character in length
- and must not exceed 4096 characters in length.
- maxLength: 4096
- minLength: 1
- type: string
- type: object
- x-kubernetes-validations:
- - message: precisely one of claim or expression must be
- set
- rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml
deleted file mode 100644
index 0fcf1d3f2c4..00000000000
--- a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml
+++ /dev/null
@@ -1,726 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.openshift.io: https://github.com/openshift/api/pull/470
- api.openshift.io/merged-by-featuregates: "true"
- include.release.openshift.io/ibm-cloud-managed: "true"
- release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: TechPreviewNoUpgrade
- name: authentications.config.openshift.io
-spec:
- group: config.openshift.io
- names:
- kind: Authentication
- listKind: AuthenticationList
- plural: authentications
- singular: authentication
- scope: Cluster
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Authentication specifies cluster-wide settings for authentication (like OAuth and
- webhook token authenticators). The canonical name of an instance is `cluster`.
-
- Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: spec holds user settable values for configuration
- properties:
- oauthMetadata:
- description: |-
- oauthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for an external OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- If oauthMetadata.name is non-empty, this value has precedence
- over any metadata reference stored in status.
- The key "oauthMetadata" is used to locate the data.
- If specified and the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcProviders:
- description: |-
- oidcProviders are OIDC identity providers that can issue tokens
- for this cluster
- Can only be set if "Type" is set to "OIDC".
-
- At most one provider can be configured.
- items:
- properties:
- claimMappings:
- description: |-
- claimMappings describes rules on how to transform information from an
- ID token into a cluster identity
- properties:
- extra:
- description: |-
- extra is an optional field for configuring the mappings
- used to construct the extra attribute for the cluster identity.
- When omitted, no extra attributes will be present on the cluster identity.
- key values for extra mappings must be unique.
- A maximum of 64 extra attribute mappings may be provided.
- items:
- description: |-
- ExtraMapping allows specifying a key and CEL expression
- to evaluate the keys' value. It is used to create additional
- mappings and attributes added to a cluster identity from
- a provided authentication token.
- properties:
- key:
- description: |-
- key is a required field that specifies the string
- to use as the extra attribute key.
-
- key must be a domain-prefix path (e.g 'example.org/foo').
- key must not exceed 510 characters in length.
- key must contain the '/' character, separating the domain and path characters.
- key must not be empty.
-
- The domain portion of the key (string of characters prior to the '/') must be a valid RFC1123 subdomain.
- It must not exceed 253 characters in length.
- It must start and end with an alphanumeric character.
- It must only contain lower case alphanumeric characters and '-' or '.'.
- It must not use the reserved domains, or be subdomains of, "kubernetes.io", "k8s.io", and "openshift.io".
-
- The path portion of the key (string of characters after the '/') must not be empty and must consist of at least one
- alphanumeric character, percent-encoded octets, '-', '.', '_', '~', '!', '$', '&', ''', '(', ')', '*', '+', ',', ';', '=', and ':'.
- It must not exceed 256 characters in length.
- maxLength: 510
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: key must contain the '/' character
- rule: self.contains('/')
- - message: the domain of the key must consist of only
- lower case alphanumeric characters, '-' or '.',
- and must start and end with an alphanumeric character
- rule: self.split('/', 2)[0].matches("^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$")
- - message: the domain of the key must not exceed 253
- characters in length
- rule: self.split('/', 2)[0].size() <= 253
- - message: the domain 'kubernetes.io' is reserved
- for Kubernetes use
- rule: self.split('/', 2)[0] != 'kubernetes.io'
- - message: the subdomains '*.kubernetes.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.kubernetes.io'')'
- - message: the domain 'k8s.io' is reserved for Kubernetes
- use
- rule: self.split('/', 2)[0] != 'k8s.io'
- - message: the subdomains '*.k8s.io' are reserved
- for Kubernetes use
- rule: '!self.split(''/'', 2)[0].endsWith(''.k8s.io'')'
- - message: the domain 'openshift.io' is reserved for
- OpenShift use
- rule: self.split('/', 2)[0] != 'openshift.io'
- - message: the subdomains '*.openshift.io' are reserved
- for OpenShift use
- rule: '!self.split(''/'', 2)[0].endsWith(''.openshift.io'')'
- - message: the path of the key must not be empty and
- must consist of at least one alphanumeric character,
- percent-encoded octets, apostrophe, '-', '.',
- '_', '~', '!', '$', '&', '(', ')', '*', '+', ',',
- ';', '=', and ':'
- rule: self.split('/', 2)[1].matches('[A-Za-z0-9/\\-._~%!$&\'()*+;=:]+')
- - message: the path of the key must not exceed 256
- characters in length
- rule: self.split('/', 2)[1].size() <= 256
- valueExpression:
- description: |-
- valueExpression is a required field to specify the CEL expression to extract
- the extra attribute value from a JWT token's claims.
- valueExpression must produce a string or string array value.
- "", [], and null are treated as the extra mapping not being present.
- Empty string values within an array are filtered out.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- valueExpression must not exceed 4096 characters in length.
- valueExpression must not be empty.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - key
- - valueExpression
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - key
- x-kubernetes-list-type: map
- groups:
- description: |-
- groups is a name of the claim that should be used to construct
- groups for the cluster identity.
- The referenced claim must use array of strings values.
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- description: |-
- prefix is a string to prefix the value from the token in the result of the
- claim mapping.
-
- By default, no prefixing occurs.
-
- Example: if `prefix` is set to "myoidc:"" and the `claim` in JWT contains
- an array of strings "a", "b" and "c", the mapping will result in an
- array of string "myoidc:a", "myoidc:b" and "myoidc:c".
- type: string
- required:
- - claim
- type: object
- uid:
- description: |-
- uid is an optional field for configuring the claim mapping
- used to construct the uid for the cluster identity.
-
- When using uid.claim to specify the claim it must be a single string value.
- When using uid.expression the expression must result in a single string value.
-
- When omitted, this means the user has no opinion and the platform
- is left to choose a default, which is subject to change over time.
- The current default is to use the 'sub' claim.
- properties:
- claim:
- description: |-
- claim is an optional field for specifying the
- JWT token claim that is used in the mapping.
- The value of this claim will be assigned to
- the field in which this mapping is associated.
-
- Precisely one of claim or expression must be set.
- claim must not be specified when expression is set.
- When specified, claim must be at least 1 character in length
- and must not exceed 256 characters in length.
- maxLength: 256
- minLength: 1
- type: string
- expression:
- description: |-
- expression is an optional field for specifying a
- CEL expression that produces a string value from
- JWT token claims.
-
- CEL expressions have access to the token claims
- through a CEL variable, 'claims'.
- 'claims' is a map of claim names to claim values.
- For example, the 'sub' claim value can be accessed as 'claims.sub'.
- Nested claims can be accessed using dot notation ('claims.foo.bar').
-
- Precisely one of claim or expression must be set.
- expression must not be specified when claim is set.
- When specified, expression must be at least 1 character in length
- and must not exceed 4096 characters in length.
- maxLength: 4096
- minLength: 1
- type: string
- type: object
- x-kubernetes-validations:
- - message: precisely one of claim or expression must be
- set
- rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
- username:
- description: |-
- username is a name of the claim that should be used to construct
- usernames for the cluster identity.
-
- Default value: "sub"
- properties:
- claim:
- description: claim is a JWT token claim to be used in
- the mapping
- type: string
- prefix:
- properties:
- prefixString:
- minLength: 1
- type: string
- required:
- - prefixString
- type: object
- prefixPolicy:
- description: |-
- prefixPolicy specifies how a prefix should apply.
-
- By default, claims other than `email` will be prefixed with the issuer URL to
- prevent naming clashes with other plugins.
-
- Set to "NoPrefix" to disable prefixing.
-
- Example:
- (1) `prefix` is set to "myoidc:" and `claim` is set to "username".
- If the JWT claim `username` contains value `userA`, the resulting
- mapped value will be "myoidc:userA".
- (2) `prefix` is set to "myoidc:" and `claim` is set to "email". If the
- JWT `email` claim contains value "userA@myoidc.tld", the resulting
- mapped value will be "myoidc:userA@myoidc.tld".
- (3) `prefix` is unset, `issuerURL` is set to `https://myoidc.tld`,
- the JWT claims include "username":"userA" and "email":"userA@myoidc.tld",
- and `claim` is set to:
- (a) "username": the mapped value will be "https://myoidc.tld#userA"
- (b) "email": the mapped value will be "userA@myoidc.tld"
- enum:
- - ""
- - NoPrefix
- - Prefix
- type: string
- required:
- - claim
- type: object
- x-kubernetes-validations:
- - message: prefix must be set if prefixPolicy is 'Prefix',
- but must remain unset otherwise
- rule: 'has(self.prefixPolicy) && self.prefixPolicy ==
- ''Prefix'' ? (has(self.prefix) && size(self.prefix.prefixString)
- > 0) : !has(self.prefix)'
- type: object
- claimValidationRules:
- description: claimValidationRules are rules that are applied
- to validate token claims to authenticate users.
- items:
- properties:
- requiredClaim:
- description: |-
- requiredClaim allows configuring a required claim name and its expected
- value
- properties:
- claim:
- description: |-
- claim is a name of a required claim. Only claims with string values are
- supported.
- minLength: 1
- type: string
- requiredValue:
- description: requiredValue is the required value for
- the claim.
- minLength: 1
- type: string
- required:
- - claim
- - requiredValue
- type: object
- type:
- default: RequiredClaim
- description: type sets the type of the validation rule
- enum:
- - RequiredClaim
- type: string
- type: object
- type: array
- x-kubernetes-list-type: atomic
- issuer:
- description: issuer describes atributes of the OIDC token issuer
- properties:
- audiences:
- description: |-
- audiences is an array of audiences that the token was issued for.
- Valid tokens must include at least one of these values in their
- "aud" claim.
- Must be set to exactly one value.
- items:
- minLength: 1
- type: string
- maxItems: 10
- minItems: 1
- type: array
- x-kubernetes-list-type: set
- issuerCertificateAuthority:
- description: |-
- CertificateAuthority is a reference to a config map in the
- configuration namespace. The .data of the configMap must contain
- the "ca-bundle.crt" key.
- If unset, system trust is used instead.
- properties:
- name:
- description: name is the metadata.name of the referenced
- config map
- type: string
- required:
- - name
- type: object
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- required:
- - audiences
- - issuerURL
- type: object
- name:
- description: name of the OIDC provider
- minLength: 1
- type: string
- oidcClients:
- description: |-
- oidcClients contains configuration for the platform's clients that
- need to request tokens from the issuer
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- clientSecret:
- description: |-
- clientSecret refers to a secret in the `openshift-config` namespace that
- contains the client secret in the `clientSecret` key of the `.data` field
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- componentName:
- description: |-
- componentName is the name of the component that is supposed to consume this
- client configuration
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: |-
- componentNamespace is the namespace of the component that is supposed to consume this
- client configuration
- maxLength: 63
- minLength: 1
- type: string
- extraScopes:
- description: extraScopes is an optional set of scopes
- to request tokens with.
- items:
- type: string
- type: array
- x-kubernetes-list-type: set
- required:
- - clientID
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- required:
- - issuer
- - name
- type: object
- maxItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- serviceAccountIssuer:
- description: |-
- serviceAccountIssuer is the identifier of the bound service account token
- issuer.
- The default is https://kubernetes.default.svc
- WARNING: Updating this field will not result in immediate invalidation of all bound tokens with the
- previous issuer value. Instead, the tokens issued by previous service account issuer will continue to
- be trusted for a time period chosen by the platform (currently set to 24h).
- This time period is subject to change over time.
- This allows internal components to transition to use new service account issuer without service distruption.
- type: string
- type:
- description: |-
- type identifies the cluster managed, user facing authentication mode in use.
- Specifically, it manages the component that responds to login attempts.
- The default is IntegratedOAuth.
- enum:
- - ""
- - None
- - IntegratedOAuth
- - OIDC
- type: string
- webhookTokenAuthenticator:
- description: |-
- webhookTokenAuthenticator configures a remote token reviewer.
- These remote authentication webhooks can be used to verify bearer tokens
- via the tokenreviews.authentication.k8s.io REST API. This is required to
- honor bearer tokens that are provisioned by an external authentication service.
-
- Can only be set if "Type" is set to "None".
- properties:
- kubeConfig:
- description: |-
- kubeConfig references a secret that contains kube config file data which
- describes how to access the remote webhook service.
- The namespace for the referenced secret is openshift-config.
-
- For further details, see:
-
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
-
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- properties:
- name:
- description: name is the metadata.name of the referenced secret
- type: string
- required:
- - name
- type: object
- required:
- - kubeConfig
- type: object
- webhookTokenAuthenticators:
- description: webhookTokenAuthenticators is DEPRECATED, setting it
- has no effect.
- items:
- description: |-
- deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator.
- It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
- properties:
- kubeConfig:
- description: |-
- kubeConfig contains kube config file data which describes how to access the remote webhook service.
- For further details, see:
- https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
- The key "kubeConfig" is used to locate the data.
- If the secret or expected key is not found, the webhook is not honored.
- If the specified kube config data is not valid, the webhook is not honored.
- The namespace for this secret is determined by the point of use.
- properties:
- name:
- description: name is the metadata.name of the referenced
- secret
- type: string
- required:
- - name
- type: object
- type: object
- type: array
- x-kubernetes-list-type: atomic
- type: object
- status:
- description: status holds observed values from the cluster. They may not
- be overridden.
- properties:
- integratedOAuthMetadata:
- description: |-
- integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0
- Authorization Server Metadata for the in-cluster integrated OAuth server.
- This discovery document can be viewed from its served location:
- oc get --raw '/.well-known/oauth-authorization-server'
- For further details, see the IETF Draft:
- https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2
- This contains the observed value based on cluster state.
- An explicitly set value in spec.oauthMetadata has precedence over this field.
- This field has no meaning if authentication spec.type is not set to IntegratedOAuth.
- The key "oauthMetadata" is used to locate the data.
- If the config map or expected key is not found, no metadata is served.
- If the specified metadata is not valid, no metadata is served.
- The namespace for this config map is openshift-config-managed.
- properties:
- name:
- description: name is the metadata.name of the referenced config
- map
- type: string
- required:
- - name
- type: object
- oidcClients:
- description: |-
- oidcClients is where participating operators place the current OIDC client status
- for OIDC clients that can be customized by the cluster-admin.
- items:
- properties:
- componentName:
- description: componentName is the name of the component that
- will consume a client configuration.
- maxLength: 256
- minLength: 1
- type: string
- componentNamespace:
- description: componentNamespace is the namespace of the component
- that will consume a client configuration.
- maxLength: 63
- minLength: 1
- type: string
- conditions:
- description: |-
- conditions are used to communicate the state of the `oidcClients` entry.
-
- Supported conditions include Available, Degraded and Progressing.
-
- If Available is true, the component is successfully using the configured client.
- If Degraded is true, that means something has gone wrong trying to handle the client configuration.
- If Progressing is true, that means the component is taking some action related to the `oidcClients` entry.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- consumingUsers:
- description: |-
- consumingUsers is a slice of ServiceAccounts that need to have read
- permission on the `clientSecret` secret.
- items:
- description: ConsumingUser is an alias for string which we
- add validation to. Currently only service accounts are supported.
- maxLength: 512
- minLength: 1
- pattern: ^system:serviceaccount:[a-z0-9]([-a-z0-9]*[a-z0-9])?:[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 5
- type: array
- x-kubernetes-list-type: set
- currentOIDCClients:
- description: currentOIDCClients is a list of clients that the
- component is currently using.
- items:
- properties:
- clientID:
- description: clientID is the identifier of the OIDC client
- from the OIDC provider
- minLength: 1
- type: string
- issuerURL:
- description: |-
- URL is the serving URL of the token issuer.
- Must use the https:// scheme.
- pattern: ^https:\/\/[^\s]
- type: string
- oidcProviderName:
- description: OIDCName refers to the `name` of the provider
- from `oidcProviders`
- minLength: 1
- type: string
- required:
- - clientID
- - issuerURL
- - oidcProviderName
- type: object
- type: array
- x-kubernetes-list-map-keys:
- - issuerURL
- - clientID
- x-kubernetes-list-type: map
- required:
- - componentName
- - componentNamespace
- type: object
- maxItems: 20
- type: array
- x-kubernetes-list-map-keys:
- - componentNamespace
- - componentName
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- x-kubernetes-validations:
- - message: all oidcClients in the oidcProviders must match their componentName
- and componentNamespace to either a previously configured oidcClient or
- they must exist in the status.oidcClients
- rule: '!has(self.spec.oidcProviders) || self.spec.oidcProviders.all(p, !has(p.oidcClients)
- || p.oidcClients.all(specC, self.status.oidcClients.exists(statusC, statusC.componentNamespace
- == specC.componentNamespace && statusC.componentName == specC.componentName)
- || (has(oldSelf.spec.oidcProviders) && oldSelf.spec.oidcProviders.exists(oldP,
- oldP.name == p.name && has(oldP.oidcClients) && oldP.oidcClients.exists(oldC,
- oldC.componentNamespace == specC.componentNamespace && oldC.componentName
- == specC.componentName)))))'
- served: true
- storage: true
- subresources:
- status: {}
diff --git a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
similarity index 99%
rename from payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml
rename to payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
index db8b07e8dd2..d5240ad0944 100644
--- a/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml
+++ b/payload-manifests/crds/0000_10_config-operator_01_authentications-Hypershift.crd.yaml
@@ -6,7 +6,6 @@ metadata:
api.openshift.io/merged-by-featuregates: "true"
include.release.openshift.io/ibm-cloud-managed: "true"
release.openshift.io/bootstrap-required: "true"
- release.openshift.io/feature-set: CustomNoUpgrade
name: authentications.config.openshift.io
spec:
group: config.openshift.io
diff --git a/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml
index 8f946b8c221..5f719f997a5 100644
--- a/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml
+++ b/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml
@@ -61,9 +61,6 @@
{
"name": "Example2"
},
- {
- "name": "ExternalOIDCWithUIDAndExtraClaimMappings"
- },
{
"name": "GCPClusterHostedDNS"
},
@@ -240,6 +237,9 @@
{
"name": "ExternalOIDC"
},
+ {
+ "name": "ExternalOIDCWithUIDAndExtraClaimMappings"
+ },
{
"name": "GCPLabelsTags"
},