Apiauth v1alpha1 — hub.traefik.io

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

The desired behavior of this APIAuth.

apiKey object

APIKey configures API key authentication.

isDefault boolean required

IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace. Only one APIAuth per namespace should have isDefault set to true.

jwt object

JWT configures JWT authentication.

appIdClaim string required

AppIDClaim is the name of the claim holding the identifier of the application. This field is sometimes named `client_id`.

forwardHeaders object

ForwardHeaders specifies additional headers to forward with the request.

jwksFile string

JWKSFile contains the JWKS file content for JWT verification. Mutually exclusive with SigningSecretName, PublicKey, JWKSURL, and TrustedIssuers.

jwksUrl string

JWKSURL is the URL to fetch the JWKS for JWT verification. Mutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers. Deprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.

publicKey string

PublicKey is the PEM-encoded public key for JWT verification. Mutually exclusive with SigningSecretName, JWKSFile, JWKSURL, and TrustedIssuers.

signingSecretName string

SigningSecretName is the name of the Kubernetes Secret containing the signing secret. The secret must be of type Opaque and contain a key named 'value'. Mutually exclusive with PublicKey, JWKSFile, JWKSURL, and TrustedIssuers.

maxLength: 253

stripAuthorizationHeader boolean

StripAuthorizationHeader determines whether to strip the Authorization header before forwarding the request.

tokenNameClaim string

TokenNameClaim is the name of the claim holding the name of the token. This name, if provided, will be used in the metrics.

tokenQueryKey string

TokenQueryKey specifies the query parameter name for the JWT token.

trustedIssuers []object

TrustedIssuers defines multiple JWKS providers with optional issuer validation. Mutually exclusive with SigningSecretName, PublicKey, JWKSFile, and JWKSURL.

minItems: 1

maxItems: 100

issuer string

Issuer is the expected value of the "iss" claim. If specified, tokens must have this exact issuer to be validated against this JWKS. The issuer value must match exactly, including trailing slashes and URL encoding. If omitted, this JWKS acts as a fallback for any issuer.

jwksUrl string required

JWKSURL is the URL to fetch the JWKS from.

ldap object

LDAP configures LDAP authentication.

attribute string

Attribute is the LDAP object attribute used to form a bind DN when sending bind queries. The bind DN is formed as <Attribute>=<Username>,<BaseDN>.

baseDn string required

BaseDN is the base domain name that should be used for bind and search queries.

bindDn string

BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode. If empty, an anonymous bind will be done.

bindPasswordSecretName string

BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN. The secret must contain a key named 'password'.

maxLength: 253

certificateAuthority string

CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the connection uses TLS but that the certificate was signed by a custom Certificate Authority.

insecureSkipVerify boolean

InsecureSkipVerify controls whether the server's certificate chain and host name is verified.

searchFilter string

SearchFilter is used to filter LDAP search queries. Example: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s)) %s can be used as a placeholder for the username.

startTls boolean

StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.

url string required

URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.

status object

The current status of this APIAuth.

conditions []object

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

hash string

Hash is a hash representing the APIAuth.

syncedAt string

format: date-time

version string