mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-29 22:51:31 +01:00
Code Issues Projects Releases Wiki Activity

docs(kubernetes-auth): add API documentation for kubernetes auth namespace selectors (#19318)

Browse Source 
Co-authored-by: Thy Ton <maithytonn@gmail.com>
This commit is contained in:
Jakob Beckmann 2024-02-01 20:41:07 +01:00 committed by GitHub
parent a4c8ce62fc
commit 2a566f40fc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
website/content/api-docs/auth/kubernetes.mdx
View File

@ -129,8 +129,14 @@ entities attempting to login.
- `name` `(string: <required>)` - Name of the role. - `name` `(string: <required>)` - Name of the role.
- `bound_service_account_names` `(array: <required>)` - List of service account - `bound_service_account_names` `(array: <required>)` - List of service account
names able to access this role. If set to "\*" all names are allowed. names able to access this role. If set to "\*" all names are allowed.
- `bound_service_account_namespaces` `(array: <required>)` - List of namespaces - `bound_service_account_namespaces` `(array: [])` - List of namespaces
allowed to access this role. If set to "\*" all namespaces are allowed. allowed to access this role. If set to "\*" all namespaces are allowed.
- `bound_service_account_namespace_selector` `(string: "")` - A label selector for Kubernetes
namespaces allowed to acces this role. Accepts either a JSON or YAML object. The value
should be of type
[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta). Currently, label selectors with `matchExpressions` are not supported.
If this parameter is used, the Vault requires permissions to read namespaces on the Kubernetes
cluster. If set with `bound_service_account_namespaces`, the conditions are `OR`ed.
- `audience` `(string: "")` - Optional Audience claim to verify in the JWT. - `audience` `(string: "")` - Optional Audience claim to verify in the JWT.
- `alias_name_source` `(string: "serviceaccount_uid")` - Configures how identity aliases are generated. - `alias_name_source` `(string: "serviceaccount_uid")` - Configures how identity aliases are generated.
Valid choices are: `serviceaccount_uid`, `serviceaccount_name` Valid choices are: `serviceaccount_uid`, `serviceaccount_name`
@ -144,7 +150,7 @@ entities attempting to login.
@include 'tokenfields.mdx' @include 'tokenfields.mdx'
### Sample payload ### Sample Payload 1
```json ```json
{ {
@ -155,7 +161,18 @@ entities attempting to login.
} }
``` ```
### Sample request ### Sample Payload 2
```json
{
"bound_service_account_names": "vault-auth",
"bound_service_account_namespace_selector": "\"{\"matchLabels\":{\"stage\":\"dev\",\"vault-role\":\"dev-role\"}}",
"policies": ["dev", "prod"],
"max_ttl": 1800000
}
```
### Sample Request
```shell-session ```shell-session
$ curl \ $ curl \