kubernetes reference nolist true contenttype tool reference weight 30 autogenerated true title kubectl kustomize

Answer:
---
title: kubectl kustomize
content_type: tool-reference
weight: 30
auto_generated: true
no_list: true
---

##

Build a set of KRM resources using a 'kustomization.yaml' file. The DIR argument must be a path to a directory containing 'kustomization.yaml', or a git repository URL with a path suffix specifying same with respect to the repository root. If DIR is omitted, '.' is assumed.

```
kubectl kustomize DIR [flags]
```

##

```
  # Build the current working directory
  kubectl kustomize

  # Build some shared configuration directory
  kubectl kustomize /home/config/production

  # Build from github
  kubectl kustomize https://github.com/kubernetes-sigs/kustomize.git/examples/helloWorld?ref=v1.0.6
```

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as-current-user

use the uid and gid of the command executor to run the function in the container

--enable-alpha-plugins

enable kustomize plugins

--enable-helm

Enable use of the Helm chart inflator generator.

-e, --env strings

a list of environment variables to be used by functions

--helm-api-versions strings

Kubernetes api versions used by Helm for Capabilities.APIVersions

--helm-command string     Default: "helm"

helm command (path to executable)

--helm-kube-version string

Kubernetes version used by Helm for Capabilities.KubeVersion

-h, --help

help for kustomize

--load-restrictor string     Default: "LoadRestrictionsRootOnly"

if set to 'LoadRestrictionsNone', local kustomizations may load files from outside their root. This does, however, break the relocatability of the kustomization.

--mount strings

a list of storage options read from the filesystem

--network

enable network access for functions that declare it

--network-name string     Default: "bridge"

the docker network to run the container in

-o, --output string

If specified, write output to this path.

##

<colgroup>
<col span="1" style="width: 10px;" />
<col span="1" />
</colgroup>

--as string

Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group strings

Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid string

UID to impersonate for the operation.

--cache-dir string     Default: "$HOME/.kube/cache"

Default cache directory

--certificate-authority string

Path to a cert file for the certificate authority

--client-certificate string

Path to a client certificate file for TLS

--client-key string

Path to a client key file for TLS

--cluster string

The name of the kubeconfig cluster to use

--context string

The name of the kubeconfig context to use

--default-not-ready-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.

--default-unreachable-toleration-seconds int     Default: 300

Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.

--disable-compression

If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify

If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig string

Path to the kubeconfig file to use for CLI requests.

--match-server-version

Require server version to match client version

-n, --namespace string

If present, the namespace scope for this CLI request

--password string

Password for basic authentication to the API server

--profile string     Default: "none"

Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output string     Default: "profile.pprof"

Name of the file to write the profile to

--request-timeout string     Default: "0"

The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server string

The address and port of the Kubernetes API server

--storage-driver-buffer-duration duration     Default: 1m0s

Writes in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction

--storage-driver-db string     Default: "cadvisor"

database name

--storage-driver-host string     Default: "localhost:8086"

database host:port

--storage-driver-password string     Default: "root"

database password

--storage-driver-secure

use secure connection with database

--storage-driver-table string     Default: "stats"

table name

--storage-driver-user string     Default: "root"

database username

--tls-server-name string

Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token string

Bearer token for authentication to the API server

--user string

The name of the kubeconfig user to use

--username string

Username for basic authentication to the API server

--version version[=true]

--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version

--warnings-as-errors

Treat warnings received from the server as errors and exit with a non-zero exit code

##

* [kubectl](../kubectl/)	 - kubectl controls the Kubernetes cluster manager

title  kubectl kustomize content type  tool reference weight  30 auto generated  true no list  true            The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the  Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project              Build a set of KRM resources using a  kustomization yaml  file  The DIR argument must be a path to a directory containing  kustomization yaml   or a git repository URL with a path suffix specifying same with respect to the repository root  If DIR is omitted      is assumed       kubectl kustomize DIR  flags                    Build the current working directory   kubectl kustomize        Build some shared configuration directory   kubectl kustomize  home config production        Build from github   kubectl kustomize https   github com kubernetes sigs kustomize git examples helloWorld ref v1 0 6               table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as current user  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use the uid and gid of the command executor to run the function in the container  p   td    tr    tr   td colspan  2    enable alpha plugins  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p enable kustomize plugins  p   td    tr    tr   td colspan  2    enable helm  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Enable use of the Helm chart inflator generator   p   td    tr    tr   td colspan  2   e    env strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p a list of environment variables to be used by functions  p   td    tr    tr   td colspan  2    helm api versions strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Kubernetes api versions used by Helm for Capabilities APIVersions  p   td    tr    tr   td colspan  2    helm command string nbsp  nbsp  nbsp  nbsp  nbsp Default   helm   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p helm command  path to executable   p   td    tr    tr   td colspan  2    helm kube version string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Kubernetes version used by Helm for Capabilities KubeVersion  p   td    tr    tr   td colspan  2   h    help  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p help for kustomize  p   td    tr    tr   td colspan  2    load restrictor string nbsp  nbsp  nbsp  nbsp  nbsp Default   LoadRestrictionsRootOnly   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p if set to  LoadRestrictionsNone   local kustomizations may load files from outside their root  This does  however  break the relocatability of the kustomization   p   td    tr    tr   td colspan  2    mount strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p a list of storage options read from the filesystem  p   td    tr    tr   td colspan  2    network  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p enable network access for functions that declare it  p   td    tr    tr   td colspan  2    network name string nbsp  nbsp  nbsp  nbsp  nbsp Default   bridge   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p the docker network to run the container in  p   td    tr    tr   td colspan  2   o    output string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If specified  write output to this path   p   td    tr     tbody    table              table style  width  100   table layout  fixed     colgroup   col span  1  style  width  10px       col span  1       colgroup   tbody    tr   td colspan  2    as string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username to impersonate for the operation  User could be a regular user or a service account in a namespace   p   td    tr    tr   td colspan  2    as group strings  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Group to impersonate for the operation  this flag can be repeated to specify multiple groups   p   td    tr    tr   td colspan  2    as uid string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p UID to impersonate for the operation   p   td    tr    tr   td colspan  2    cache dir string nbsp  nbsp  nbsp  nbsp  nbsp Default    HOME  kube cache   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Default cache directory  p   td    tr    tr   td colspan  2    certificate authority string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a cert file for the certificate authority  p   td    tr    tr   td colspan  2    client certificate string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client certificate file for TLS  p   td    tr    tr   td colspan  2    client key string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to a client key file for TLS  p   td    tr    tr   td colspan  2    cluster string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig cluster to use  p   td    tr    tr   td colspan  2    context string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig context to use  p   td    tr    tr   td colspan  2    default not ready toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for notReady NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    default unreachable toleration seconds int nbsp  nbsp  nbsp  nbsp  nbsp Default  300  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Indicates the tolerationSeconds of the toleration for unreachable NoExecute that is added by default to every pod that does not already have such a toleration   p   td    tr    tr   td colspan  2    disable compression  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  opt out of response compression for all requests to the server  p   td    tr    tr   td colspan  2    insecure skip tls verify  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If true  the server s certificate will not be checked for validity  This will make your HTTPS connections insecure  p   td    tr    tr   td colspan  2    kubeconfig string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Path to the kubeconfig file to use for CLI requests   p   td    tr    tr   td colspan  2    match server version  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Require server version to match client version  p   td    tr    tr   td colspan  2   n    namespace string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p If present  the namespace scope for this CLI request  p   td    tr    tr   td colspan  2    password string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Password for basic authentication to the API server  p   td    tr    tr   td colspan  2    profile string nbsp  nbsp  nbsp  nbsp  nbsp Default   none   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of profile to capture  One of  none cpu heap goroutine threadcreate block mutex   p   td    tr    tr   td colspan  2    profile output string nbsp  nbsp  nbsp  nbsp  nbsp Default   profile pprof   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Name of the file to write the profile to  p   td    tr    tr   td colspan  2    request timeout string nbsp  nbsp  nbsp  nbsp  nbsp Default   0   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The length of time to wait before giving up on a single server request  Non zero values should contain a corresponding time unit  e g  1s  2m  3h   A value of zero means don t timeout requests   p   td    tr    tr   td colspan  2   s    server string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The address and port of the Kubernetes API server  p   td    tr    tr   td colspan  2    storage driver buffer duration duration nbsp  nbsp  nbsp  nbsp  nbsp Default  1m0s  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Writes in the storage driver will be buffered for this duration  and committed to the non memory backends as a single transaction  p   td    tr    tr   td colspan  2    storage driver db string nbsp  nbsp  nbsp  nbsp  nbsp Default   cadvisor   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database name  p   td    tr    tr   td colspan  2    storage driver host string nbsp  nbsp  nbsp  nbsp  nbsp Default   localhost 8086   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database host port  p   td    tr    tr   td colspan  2    storage driver password string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database password  p   td    tr    tr   td colspan  2    storage driver secure  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p use secure connection with database  p   td    tr    tr   td colspan  2    storage driver table string nbsp  nbsp  nbsp  nbsp  nbsp Default   stats   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p table name  p   td    tr    tr   td colspan  2    storage driver user string nbsp  nbsp  nbsp  nbsp  nbsp Default   root   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p database username  p   td    tr    tr   td colspan  2    tls server name string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Server name to use for server certificate validation  If it is not provided  the hostname used to contact the server is used  p   td    tr    tr   td colspan  2    token string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Bearer token for authentication to the API server  p   td    tr    tr   td colspan  2    user string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p The name of the kubeconfig user to use  p   td    tr    tr   td colspan  2    username string  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Username for basic authentication to the API server  p   td    tr    tr   td colspan  2    version version  true   td    tr   tr   td   td  td style  line height  130   word wrap  break word    p   version    version raw prints version information and quits    version vX Y Z    sets the reported version  p   td    tr    tr   td colspan  2    warnings as errors  td    tr   tr   td   td  td style  line height  130   word wrap  break word    p Treat warnings received from the server as errors and exit with a non zero exit code  p   td    tr     tbody    table             kubectl     kubectl      kubectl controls the Kubernetes cluster manager


kubernetes reference liggitt deads2k erictune contenttype concept weight 10 reviewers title Authenticating lavalamp

reviewers    erictune   lavalamp   deads2k   liggitt title  Authenticating content type  concept weight  10           overview     This page provides an overview of authentication        body        Users in Kubernetes  All Kubernetes clusters have two categories of users  service accounts managed by Kubernetes  and normal users   It is assumed that a cluster independent service manages normal users in the following ways     an administrator distributing private keys   a user store like Keystone or Google Accounts   a file with a list of usernames and passwords  In this regard   Kubernetes does not have objects which represent normal user accounts   Normal users cannot be added to a cluster through an API call   Even though a normal user cannot be added via an API call  any user that presents a valid certificate signed by the cluster s certificate authority  CA  is considered authenticated  In this configuration  Kubernetes determines the username from the common name field in the  subject  of the cert  e g     CN bob    From there  the role based access control  RBAC  sub system would determine whether the user is authorized to perform a specific operation on a resource  For more details  refer to the normal users topic in  certificate request   docs reference access authn authz certificate signing requests  normal user  for more details about this   In contrast  service accounts are users managed by the Kubernetes API  They are bound to specific namespaces  and created automatically by the API server or manually through API calls  Service accounts are tied to a set of credentials stored as  Secrets   which are mounted into pods allowing in cluster processes to talk to the Kubernetes API   API requests are tied to either a normal user or a service account  or are treated as  anonymous requests   anonymous requests   This means every process inside or outside the cluster  from a human user typing  kubectl  on a workstation  to  kubelets  on nodes  to members of the control plane  must authenticate when making requests to the API server  or be treated as an anonymous user      Authentication strategies  Kubernetes uses client certificates  bearer tokens  or an authenticating proxy to authenticate API requests through authentication plugins  As HTTP requests are made to the API server  plugins attempt to associate the following attributes with the request     Username  a string which identifies the end user  Common values might be  kube admin  or  jane example com     UID  a string which identifies the end user and attempts to be more consistent and unique than username    Groups  a set of strings  each of which indicates the user s membership in a named logical collection of users    Common values might be  system masters  or  devops team     Extra fields  a map of strings to list of strings which holds additional information authorizers may find useful   All values are opaque to the authentication system and only hold significance when interpreted by an  authorizer   docs reference access authn authz authorization     You can enable multiple authentication methods at once  You should usually use at least two methods     service account tokens for service accounts   at least one other method for user authentication   When multiple authenticator modules are enabled  the first module to successfully authenticate the request short circuits evaluation  The API server does not guarantee the order authenticators run in   The  system authenticated  group is included in the list of groups for all authenticated users   Integrations with other authentication protocols  LDAP  SAML  Kerberos  alternate x509 schemes  etc  can be accomplished using an  authenticating proxy   authenticating proxy  or the  authentication webhook   webhook token authentication        X509 client certificates  Client certificate authentication is enabled by passing the    client ca file SOMEFILE  option to API server  The referenced file must contain one or more certificate authorities to use to validate client certificates presented to the API server  If a client certificate is presented and verified  the common name of the subject is used as the user name for the request  As of Kubernetes 1 4  client certificates can also indicate a user s group memberships using the certificate s organization fields  To include multiple group memberships for a user  include multiple organization fields in the certificate   For example  using the  openssl  command line tool to generate a certificate signing request      bash openssl req  new  key jbeda pem  out jbeda csr pem  subj   CN jbeda O app1 O app2       This would create a CSR for the username  jbeda   belonging to two groups   app1  and  app2    See  Managing Certificates   docs tasks administer cluster certificates   for how to generate a client cert       Static token file  The API server reads bearer tokens from a file when given the    token auth file SOMEFILE  option on the command line  Currently  tokens last indefinitely  and the token list cannot be changed without restarting the API server   The token file is a csv file with a minimum of 3 columns  token  user name  user uid  followed by optional group names    If you have more than one group  the column must be double quoted e g      conf token user uid  group1 group2 group3             Putting a bearer token in a request  When using bearer token authentication from an http client  the API server expects an  Authorization  header with a value of  Bearer  token    The bearer token must be a character sequence that can be put in an HTTP header value using no more than the encoding and quoting facilities of HTTP  For example  if the bearer token is  31ada4fd adec 460c 809a 9e56ceb75269  then it would appear in an HTTP header as shown below      http Authorization  Bearer 31ada4fd adec 460c 809a 9e56ceb75269          Bootstrap tokens    To allow for streamlined bootstrapping for new clusters  Kubernetes includes a dynamically managed Bearer token type called a  Bootstrap Token   These tokens are stored as Secrets in the  kube system  namespace  where they can be dynamically managed and created  Controller Manager contains a TokenCleaner controller that deletes bootstrap tokens as they expire   The tokens are of the form   a z0 9  6   a z0 9  16    The first component is a Token ID and the second component is the Token Secret  You specify the token in an HTTP header as follows      http Authorization  Bearer 781292 db7bc3a58fc5f07e      You must enable the Bootstrap Token Authenticator with the    enable bootstrap token auth  flag on the API Server  You must enable the TokenCleaner controller via the    controllers  flag on the Controller Manager  This is done with something like    controllers   tokencleaner    kubeadm  will do this for you if you are using it to bootstrap a cluster   The authenticator authenticates as  system bootstrap  Token ID    It is included in the  system bootstrappers  group  The naming and groups are intentionally limited to discourage users from using these tokens past bootstrapping  The user names and group can be used  and are used by  kubeadm   to craft the appropriate authorization policies to support bootstrapping a cluster   Please see  Bootstrap Tokens   docs reference access authn authz bootstrap tokens   for in depth documentation on the Bootstrap Token authenticator and controllers along with how to manage these tokens with  kubeadm        Service account tokens  A service account is an automatically enabled authenticator that uses signed bearer tokens to verify requests  The plugin takes two optional flags        service account key file  File containing PEM encoded x509 RSA or ECDSA   private or public keys  used to verify ServiceAccount tokens  The specified file   can contain multiple keys  and the flag can be specified multiple times with   different files  If unspecified    tls private key file is used       service account lookup  If enabled  tokens which are deleted from the API will be revoked   Service accounts are usually created automatically by the API server and associated with pods running in the cluster through the  ServiceAccount   Admission Controller   docs reference access authn authz admission controllers    Bearer tokens are mounted into pods at well known locations  and allow in cluster processes to talk to the API server  Accounts may be explicitly associated with pods using the  serviceAccountName  field of a  PodSpec      serviceAccountName  is usually omitted because this is done automatically       yaml apiVersion  apps v1   this apiVersion is relevant as of Kubernetes 1 9 kind  Deployment metadata    name  nginx deployment   namespace  default spec    replicas  3   template      metadata                spec        serviceAccountName  bob the bot       containers          name  nginx         image  nginx 1 14 2      Service account bearer tokens are perfectly valid to use outside the cluster and can be used to create identities for long standing jobs that wish to talk to the Kubernetes API  To manually create a service account  use the  kubectl create serviceaccount  NAME   command  This creates a service account in the current namespace      bash kubectl create serviceaccount jenkins         none serviceaccount jenkins created      Create an associated token      bash kubectl create token jenkins         none eyJhbGciOiJSUzI1NiIsImtp         The created token is a signed JSON Web Token  JWT    The signed JWT can be used as a bearer token to authenticate as the given service account  See  above   putting a bearer token in a request  for how the token is included in a request  Normally these tokens are mounted into pods for in cluster access to the API server  but can be used from outside the cluster as well   Service accounts authenticate with the username  system serviceaccount  NAMESPACE   SERVICEACCOUNT    and are assigned to the groups  system serviceaccounts  and  system serviceaccounts  NAMESPACE      Because service account tokens can also be stored in Secret API objects  any user with write access to Secrets can request a token  and any user with read access to those Secrets can authenticate as the service account  Be cautious when granting permissions to service accounts and read or write capabilities for Secrets        OpenID Connect Tokens   OpenID Connect  https   openid net connect   is a flavor of OAuth2 supported by some OAuth2 providers  notably Microsoft Entra ID  Salesforce  and Google  The protocol s main extension of OAuth2 is an additional field returned with the access token called an  ID Token  https   openid net specs openid connect core 1 0 html IDToken   This token is a JSON Web Token  JWT  with well known fields  such as a user s email  signed by the server   To identify the user  the authenticator uses the  id token   not the  access token   from the OAuth2  token response  https   openid net specs openid connect core 1 0 html TokenResponse  as a bearer token  See  above   putting a bearer token in a request  for how the token is included in a request    sequenceDiagram     participant user as User     participant idp as Identity Provider     participant kube as kubectl     participant api as API Server      user     idp  1  Log in to IdP     activate idp     idp      user  2  Provide access token  br id token  and refresh token     deactivate idp     activate user     user     kube  3  Call kubectl br with   token being the id token br OR add tokens to  kube config     deactivate user     activate kube     kube     api  4  Authorization  Bearer        deactivate kube     activate api     api     api  5  Is JWT signature valid      api     api  6  Has the JWT expired   iat exp      api     api  7  User authorized      api      kube  8  Authorized  Perform br action and return result     deactivate api     activate kube     kube   x user  9  Return result     deactivate kube   1  Log in to your identity provider 1  Your identity provider will provide you with an  access token    id token  and a  refresh token  1  When using  kubectl   use your  id token  with the    token  flag or add it directly to your  kubeconfig  1   kubectl  sends your  id token  in a header called Authorization to the API server 1  The API server will make sure the JWT signature is valid 1  Check to make sure the  id token  hasn t expired     Perform claim and or user validation if CEL expressions are configured with  AuthenticationConfiguration    1  Make sure the user is authorized 1  Once authorized the API server returns a response to  kubectl  1   kubectl  provides feedback to the user  Since all of the data needed to validate who you are is in the  id token   Kubernetes doesn t need to  phone home  to the identity provider  In a model where every request is stateless this provides a very scalable solution for authentication  It does offer a few challenges   1  Kubernetes has no  web interface  to trigger the authentication process  There is no browser or    interface to collect credentials which is why you need to authenticate to your identity provider first  1  The  id token  can t be revoked  it s like a certificate so it should be short lived  only a few minutes     so it can be very annoying to have to get a new token every few minutes  1  To authenticate to the Kubernetes dashboard  you must use the  kubectl proxy  command or a reverse proxy    that injects the  id token         Configuring the API Server        Using flags  To enable the plugin  configure the following flags on the API server     Parameter   Description   Example   Required                                                        oidc issuer url    URL of the provider that allows the API server to discover public signing keys  Only URLs that use the  https     scheme are accepted  This is typically the provider s discovery URL  changed to have an empty path    If the issuer s OIDC discovery URL is  https   accounts provider example  well known openid configuration   the value should be  https   accounts provider example    Yes        oidc client id     A client id that all tokens must be issued for    kubernetes   Yes        oidc username claim    JWT claim to use as the user name  By default  sub   which is expected to be a unique identifier of the end user  Admins can choose other claims  such as  email  or  name   depending on their provider  However  claims other than  email  will be prefixed with the issuer URL to prevent naming clashes with other plugins    sub   No        oidc username prefix    Prefix prepended to username claims to prevent clashes with existing names  such as  system   users   For example  the value  oidc   will create usernames like  oidc jane doe   If this flag isn t provided and    oidc username claim  is a value other than  email  the prefix defaults to    Issuer URL     where    Issuer URL    is the value of    oidc issuer url   The value     can be used to disable all prefixing     oidc     No        oidc groups claim    JWT claim to use as the user s group  If the claim is present it must be an array of strings    groups   No        oidc groups prefix    Prefix prepended to group claims to prevent clashes with existing names  such as  system   groups   For example  the value  oidc   will create group names like  oidc engineering  and  oidc infra      oidc     No        oidc required claim    A key value pair that describes a required claim in the ID Token  If set  the claim is verified to be present in the ID Token with a matching value  Repeat this flag to specify multiple claims     claim value    No        oidc ca file    The path to the certificate for the CA that signed your identity provider s web certificate  Defaults to the host s root CAs      etc kubernetes ssl kc ca pem    No        oidc signing algs    The signing algorithms accepted  Default is  RS256      RS512    No          Authentication configuration from a file   using authentication configuration     JWT Authenticator is an authenticator to authenticate Kubernetes users using JWT compliant tokens  The authenticator will attempt to parse a raw ID token  verify it s been signed by the configured issuer  The public key to verify the signature is discovered from the issuer s public endpoint using OIDC discovery   The minimum valid JWT payload must contain the following claims      json      iss    https   example com        must match the issuer url    aud     my app                    at least one of the entries in issuer audiences must match the  aud  claim in presented JWTs     exp   1234567890                  token expiration as Unix time  the number of seconds elapsed since January 1  1970 UTC      username claim     user          this is the username claim configured in the claimMappings username claim or claimMappings username expression        The configuration file approach allows you to configure multiple JWT authenticators  each with a unique  issuer url  and  issuer discoveryURL   The configuration file even allows you to specify  CEL   docs reference using api cel   expressions to map claims to user attributes  and to validate claims and user information  The API server also automatically reloads the authenticators when the configuration file is modified  You can use  apiserver authentication config controller automatic reload last timestamp seconds  metric to monitor the last time the configuration was reloaded by the API server   You must specify the path to the authentication configuration using the    authentication config  flag on the API server  If you want to use command line flags instead of the configuration file  those will continue to work as is  To access the new capabilities like configuring multiple authenticators  setting multiple audiences for an issuer  switch to using the configuration file   For Kubernetes v  the structured authentication configuration file format is beta level  and the mechanism for using that configuration is also beta  Provided you didn t specifically disable the  StructuredAuthenticationConfiguration   feature gate   docs reference command line tools reference feature gates   for your cluster  you can turn on structured authentication by specifying the    authentication config  command line argument to the kube apiserver  An example of the structured authentication configuration file is shown below    If you specify    authentication config  along with any of the    oidc    command line arguments  this is a misconfiguration  In this situation  the API server reports an error and then immediately exits  If you want to switch to using structured authentication configuration  you have to remove the    oidc    command line arguments  and use the configuration file instead       yaml         CAUTION  this is an example configuration             Do not use this for your own cluster    apiVersion  apiserver config k8s io v1beta1 kind  AuthenticationConfiguration   list of authenticators to authenticate Kubernetes users using JWT compliant tokens    the maximum number of allowed authenticators is 64  jwt    issuer        url must be unique across all authenticators        url must not conflict with issuer configured in   service account issuer      url  https   example com   Same as   oidc issuer url        discoveryURL  if specified  overrides the URL used to fetch discovery       information instead of using   url   well known openid configuration         The exact value specified is used  so    well known openid configuration        must be included in discoveryURL if needed              The  issuer  field in the fetched discovery information must match the  issuer url  field       in the AuthenticationConfiguration and will be used to validate the  iss  claim in the presented JWT        This is for scenarios where the well known and jwks endpoints are hosted at a different       location than the issuer  such as locally in the cluster         discoveryURL must be different from url if specified and must be unique across all authenticators      discoveryURL  https   discovery example com  well known openid configuration       PEM encoded CA certificates used to validate the connection when fetching       discovery information  If not set  the system verifier will be used        Same value as the content of the file referenced by the   oidc ca file flag      certificateAuthority   PEM encoded CA certificates            audiences is the set of acceptable audiences the JWT must be issued to        At least one of the entries must match the  aud  claim in presented JWTs      audiences        my app   Same as   oidc client id        my other app       this is required to be set to  MatchAny  when multiple audiences are specified      audienceMatchPolicy  MatchAny     rules applied to validate token claims to authenticate users    claimValidationRules        Same as   oidc required claim key value      claim  hd     requiredValue  example com       Instead of claim and requiredValue  you can use expression to validate the claim        expression is a CEL expression that evaluates to a boolean        all the expressions must evaluate to true for validation to succeed      expression   claims hd     example com         Message customizes the error message seen in the API server logs when the validation fails      message  the hd claim must be set to example com     expression   claims exp   claims nbf    86400      message  total token lifetime must not exceed 24 hours   claimMappings        username represents an option for the username attribute        This is the only required attribute      username          Same as   oidc username claim  Mutually exclusive with username expression        claim   sub          Same as   oidc username prefix  Mutually exclusive with username expression          if username claim is set  username prefix is required          Explicitly set it to    if no prefix is desired        prefix             Mutually exclusive with username claim and username prefix          expression is a CEL expression that evaluates to a string                  1   If username expression uses  claims email   then  claims email verified  must be used in             username expression or extra    valueExpression or claimValidationRules    expression              An example claim validation rule expression that matches the validation automatically             applied when username claim is set to  email  is  claims  email verified orValue true            2   If the username asserted based on username expression is the empty string  the authentication             request will fail        expression   claims username     external user         groups represents an option for the groups attribute      groups          Same as   oidc groups claim  Mutually exclusive with groups expression        claim   sub          Same as   oidc groups prefix  Mutually exclusive with groups expression          if groups claim is set  groups prefix is required          Explicitly set it to    if no prefix is desired        prefix             Mutually exclusive with groups claim and groups prefix          expression is a CEL expression that evaluates to a string or a list of strings        expression   claims roles split             uid represents an option for the uid attribute      uid          Mutually exclusive with uid expression        claim   sub          Mutually exclusive with uid claim         expression is a CEL expression that evaluates to a string        expression   claims sub        extra attributes to be added to the UserInfo object  Keys must be domain prefix path and must be unique      extra        key   example com tenant          valueExpression is a CEL expression that evaluates to a string or a list of strings        valueExpression   claims tenant      validation rules applied to the final user object    userValidationRules        expression is a CEL expression that evaluates to a boolean        all the expressions must evaluate to true for the user to be valid      expression    user username startsWith  system           Message customizes the error message seen in the API server logs when the validation fails      message   username cannot used reserved system  prefix      expression   user groups all group   group startsWith  system          message   groups cannot used reserved system  prefix         Claim validation rule expression     jwt claimValidationRules i  expression  represents the expression which will be evaluated by CEL    CEL expressions have access to the contents of the token payload  organized into  claims  CEL variable     claims  is a map of claim names  as strings  to claim values  of any type      User validation rule expression     jwt userValidationRules i  expression  represents the expression which will be evaluated by CEL    CEL expressions have access to the contents of  userInfo   organized into  user  CEL variable    Refer to the  UserInfo   docs reference generated kubernetes api v  userinfo v1 authentication k8s io    API documentation for the schema of  user      Claim mapping expression     jwt claimMappings username expression    jwt claimMappings groups expression    jwt claimMappings uid expression     jwt claimMappings extra i  valueExpression  represents the expression which will be evaluated by CEL    CEL expressions have access to the contents of the token payload  organized into  claims  CEL variable     claims  is a map of claim names  as strings  to claim values  of any type      To learn more  see the  Documentation on CEL   docs reference using api cel      Here are examples of the  AuthenticationConfiguration  with different token payloads              yaml   apiVersion  apiserver config k8s io v1beta1   kind  AuthenticationConfiguration   jwt      issuer        url  https   example com       audiences          my app     claimMappings        username          expression   claims username     external user         groups          expression   claims roles split             uid          expression   claims sub        extra          key   example com tenant          valueExpression   claims tenant      userValidationRules        expression    user username startsWith  system       the expression will evaluate to true  so validation will succeed        message   username cannot used reserved system  prefix              bash   TOKEN eyJhbGciOiJSUzI1NiIsImtpZCI6ImY3dF9tOEROWmFTQk1oWGw5QXZTWGhBUC04Y0JmZ0JVbFVpTG5oQkgxdXMiLCJ0eXAiOiJKV1QifQ eyJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNzAzMjMyOTQ5LCJpYXQiOjE3MDExMDcyMzMsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS5jb20iLCJqdGkiOiI3YzMzNzk0MjgwN2U3M2NhYTJjMzBjODY4YWMwY2U5MTBiY2UwMmRkY2JmZWJlOGMyM2I4YjVmMjdhZDYyODczIiwibmJmIjoxNzAxMTA3MjMzLCJyb2xlcyI6InVzZXIsYWRtaW4iLCJzdWIiOiJhdXRoIiwidGVuYW50IjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjRhIiwidXNlcm5hbWUiOiJmb28ifQ TBWF2RkQHm4QQz85AYPcwLxSk VLvQW mNDHx7SEOSv9LVwcPYPuPajJpuQn9C gKq1R94QKSQ5F6UgHMILz8OfmPKmX 00wpwwNVGeevJ79ieX2V   W56iNR5gJ i9nn6FYk5pwfVREB0l4HSlpTOmu80gbPWAXY5hLW0ZtcE1JTEEmefORHV2ge8e3jp1xGafNy6LdJWabYuKiw8d7Qga  HxtKB t0kRMNzLRS7rka SfQg0dSYektuxhLbiDkqhmRffGlQKXGVzUsuvFw7IGM5ZWnZgEMDzCI357obHeM3tRqpn5WRjtB8oM7JgnCymaJi P3iCd88iu1xnzA          where the token payload is        json              aud    kubernetes          exp   1703232949         iat   1701107233         iss    https   example com          jti    7c337942807e73caa2c30c868ac0ce910bce02ddcbfebe8c23b8b5f27ad62873          nbf   1701107233         roles    user admin          sub    auth          tenant    72f988bf 86f1 41af 91ab 2d7cd011db4a          username    foo                 The token with the above  AuthenticationConfiguration  will produce the following  UserInfo  object and successfully authenticate the user        json            username    foo external user          uid    auth          groups                user              admin                  extra                example com tenant    72f988bf 86f1 41af 91ab 2d7cd011db4a                               yaml   apiVersion  apiserver config k8s io v1beta1   kind  AuthenticationConfiguration   jwt      issuer        url  https   example com       audiences          my app     claimValidationRules        expression   claims hd     example com     the token below does not have this claim  so validation will fail        message  the hd claim must be set to example com     claimMappings        username          expression   claims username     external user         groups          expression   claims roles split             uid          expression   claims sub        extra          key   example com tenant          valueExpression   claims tenant      userValidationRules        expression    user username startsWith  system       the expression will evaluate to true  so validation will succeed        message   username cannot used reserved system  prefix              bash   TOKEN eyJhbGciOiJSUzI1NiIsImtpZCI6ImY3dF9tOEROWmFTQk1oWGw5QXZTWGhBUC04Y0JmZ0JVbFVpTG5oQkgxdXMiLCJ0eXAiOiJKV1QifQ eyJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNzAzMjMyOTQ5LCJpYXQiOjE3MDExMDcyMzMsImlzcyI6Imh0dHBzOi8vZXhhbXBsZS5jb20iLCJqdGkiOiI3YzMzNzk0MjgwN2U3M2NhYTJjMzBjODY4YWMwY2U5MTBiY2UwMmRkY2JmZWJlOGMyM2I4YjVmMjdhZDYyODczIiwibmJmIjoxNzAxMTA3MjMzLCJyb2xlcyI6InVzZXIsYWRtaW4iLCJzdWIiOiJhdXRoIiwidGVuYW50IjoiNzJmOTg4YmYtODZmMS00MWFmLTkxYWItMmQ3Y2QwMTFkYjRhIiwidXNlcm5hbWUiOiJmb28ifQ TBWF2RkQHm4QQz85AYPcwLxSk VLvQW mNDHx7SEOSv9LVwcPYPuPajJpuQn9C gKq1R94QKSQ5F6UgHMILz8OfmPKmX 00wpwwNVGeevJ79ieX2V   W56iNR5gJ i9nn6FYk5pwfVREB0l4HSlpTOmu80gbPWAXY5hLW0ZtcE1JTEEmefORHV2ge8e3jp1xGafNy6LdJWabYuKiw8d7Qga  HxtKB t0kRMNzLRS7rka SfQg0dSYektuxhLbiDkqhmRffGlQKXGVzUsuvFw7IGM5ZWnZgEMDzCI357obHeM3tRqpn5WRjtB8oM7JgnCymaJi P3iCd88iu1xnzA          where the token payload is        json              aud    kubernetes          exp   1703232949         iat   1701107233         iss    https   example com          jti    7c337942807e73caa2c30c868ac0ce910bce02ddcbfebe8c23b8b5f27ad62873          nbf   1701107233         roles    user admin          sub    auth          tenant    72f988bf 86f1 41af 91ab 2d7cd011db4a          username    foo                 The token with the above  AuthenticationConfiguration  will fail to authenticate because the    hd  claim is not set to  example com   The API server will return  401 Unauthorized  error             yaml   apiVersion  apiserver config k8s io v1beta1   kind  AuthenticationConfiguration   jwt      issuer        url  https   example com       audiences          my app     claimValidationRules        expression   claims hd     example com         message  the hd claim must be set to example com     claimMappings        username          expression    system     claims username    this will prefix the username with  system   and will fail user validation        groups          expression   claims roles split             uid          expression   claims sub        extra          key   example com tenant          valueExpression   claims tenant      userValidationRules        expression    user username startsWith  system       the username will be system foo and expression will evaluate to false  so validation will fail        message   username cannot used reserved system  prefix              bash   TOKEN eyJhbGciOiJSUzI1NiIsImtpZCI6ImY3dF9tOEROWmFTQk1oWGw5QXZTWGhBUC04Y0JmZ0JVbFVpTG5oQkgxdXMiLCJ0eXAiOiJKV1QifQ eyJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNzAzMjMyOTQ5LCJoZCI6ImV4YW1wbGUuY29tIiwiaWF0IjoxNzAxMTEzMTAxLCJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tIiwianRpIjoiYjViMDY1MjM3MmNkMjBlMzQ1YjZmZGZmY2RjMjE4MWY0YWZkNmYyNTlhYWI0YjdlMzU4ODEyMzdkMjkyMjBiYyIsIm5iZiI6MTcwMTExMzEwMSwicm9sZXMiOiJ1c2VyLGFkbWluIiwic3ViIjoiYXV0aCIsInRlbmFudCI6IjcyZjk4OGJmLTg2ZjEtNDFhZi05MWFiLTJkN2NkMDExZGI0YSIsInVzZXJuYW1lIjoiZm9vIn0 FgPJBYLobo9jnbHreooBlvpgEcSPWnKfX6dc0IvdlRB F0dCcgy91oCJeK aBk 8zH5AKUXoFTlInfLCkPivMOJqMECA1YTrMUwt IVqwb116AqihfByUYIIqzMjvUbthtbpIeHQm2fF0HbrUqa Q0uaYwgy8mD807h7sBcUMjNd215ff nFIHss 9zegH8GI1d9fiBf g6zjkR1j987EP748khpQh9IxPjMJbSgG uH5x80YFuqgEWwq aYJPQxXX6FatP96a2EAn7wfPpGlPRt0HcBOvq5pCnudgCgfVgiOJiLr 7robQu4T1bis0W75VPEvwWtgFcLnvcQx0JWg          where the token payload is        json              aud    kubernetes          exp   1703232949         hd    example com          iat   1701113101         iss    https   example com          jti    b5b0652372cd20e345b6fdffcdc2181f4afd6f259aab4b7e35881237d29220bc          nbf   1701113101         roles    user admin          sub    auth          tenant    72f988bf 86f1 41af 91ab 2d7cd011db4a          username    foo                 The token with the above  AuthenticationConfiguration  will produce the following  UserInfo  object        json            username    system foo          uid    auth          groups                user              admin                  extra                example com tenant    72f988bf 86f1 41af 91ab 2d7cd011db4a                       which will fail user validation because the username starts with  system      The API server will return  401 Unauthorized  error                Limitations  1  Distributed claims do not work via  CEL   docs reference using api cel   expressions  1  Egress selector configuration is not supported for calls to  issuer url  and  issuer discoveryURL    Kubernetes does not provide an OpenID Connect Identity Provider  You can use an existing public OpenID Connect Identity Provider  such as Google  or  others  https   connect2id com products nimbus oauth openid connect sdk openid connect providers    Or  you can run your own Identity Provider  such as  dex  https   dexidp io     Keycloak  https   github com keycloak keycloak   CloudFoundry  UAA  https   github com cloudfoundry uaa   or Tremolo Security s  OpenUnison  https   openunison github io     For an identity provider to work with Kubernetes it must   1  Support  OpenID connect discovery  https   openid net specs openid connect discovery 1 0 html      The public key to verify the signature is discovered from the issuer s public endpoint using OIDC discovery     If you re using the authentication configuration file  the identity provider doesn t need to publicly expose the discovery endpoint     You can host the discovery endpoint at a different location than the issuer  such as locally in the cluster  and specify the     issuer discoveryURL  in the configuration file   1  Run in TLS with non obsolete ciphers 1  Have a CA signed certificate  even if the CA is not a commercial CA or is self signed   A note about requirement  3 above  requiring a CA signed certificate  If you deploy your own identity provider  as opposed to one of the cloud providers like Google or Microsoft  you MUST have your identity provider s web server certificate signed by a certificate with the  CA  flag set to  TRUE   even if it is self signed  This is due to GoLang s TLS client implementation being very strict to the standards around certificate validation  If you don t have a CA handy  you can use the  gencert script  https   github com dexidp dex blob master examples k8s gencert sh  from the Dex team to create a simple CA and a signed certificate and key pair  Or you can use  this similar script  https   raw githubusercontent com TremoloSecurity openunison qs kubernetes master src main bash makessl sh  that generates SHA256 certs with a longer life and larger key size   Refer to setup instructions for specific systems      UAA  https   docs cloudfoundry org concepts architecture uaa html     Dex  https   dexidp io docs kubernetes      OpenUnison  https   www tremolosecurity com orchestra k8s         Using kubectl        Option 1   OIDC Authenticator  The first option is to use the kubectl  oidc  authenticator  which sets the  id token  as a bearer token for all requests and refreshes the token once it expires  After you ve logged into your provider  use kubectl to add your  id token    refresh token    client id   and  client secret  to configure the plugin   Providers that don t return an  id token  as part of their refresh token response aren t supported by this plugin and should use  Option 2  below      bash kubectl config set credentials USER NAME        auth provider oidc        auth provider arg idp issuer url   issuer url          auth provider arg client id   your client id          auth provider arg client secret   your client secret          auth provider arg refresh token   your refresh token          auth provider arg idp certificate authority   path to your ca certificate          auth provider arg id token   your id token        As an example  running the below command after authenticating to your identity provider      bash kubectl config set credentials mmosley              auth provider oidc              auth provider arg idp issuer url https   oidcidp tremolo lan 8443 auth idp OidcIdP              auth provider arg client id kubernetes              auth provider arg client secret 1db158f6 177d 4d9c 8a8b d36869918ec5              auth provider arg refresh token q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW VlFUeVRGcluyVF5JT4 haZmPsluFoFu5XkpXk5BXqHega4GAXlF ma vmYpFcHe5eZR slBFpZKtQA              auth provider arg idp certificate authority  root ca pem             auth provider arg id token eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ w6p4J 6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW p mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3 UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401 RPQzPGMVBld0 zMCAwZttJ4knw      Which would produce the below configuration      yaml users    name  mmosley   user      auth provider        config          client id  kubernetes         client secret  1db158f6 177d 4d9c 8a8b d36869918ec5         id token  eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ w6p4J 6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW p mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3 UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401 RPQzPGMVBld0 zMCAwZttJ4knw         idp certificate authority   root ca pem         idp issuer url  https   oidcidp tremolo lan 8443 auth idp OidcIdP         refresh token  q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW VlFUeVRGcluyVF5JT4 haZmPsluFoFu5XkpXk5BXq       name  oidc      Once your  id token  expires   kubectl  will attempt to refresh your  id token  using your  refresh token  and  client secret  storing the new values for the  refresh token  and  id token  in your   kube config          Option 2   Use the    token  Option  The  kubectl  command lets you pass in a token using the    token  option  Copy and paste the  id token  into this option      bash kubectl   token eyJhbGciOiJSUzI1NiJ9 eyJpc3MiOiJodHRwczovL21sYi50cmVtb2xvLmxhbjo4MDQzL2F1dGgvaWRwL29pZGMiLCJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNDc0NTk2NjY5LCJqdGkiOiI2RDUzNXoxUEpFNjJOR3QxaWVyYm9RIiwiaWF0IjoxNDc0NTk2MzY5LCJuYmYiOjE0NzQ1OTYyNDksInN1YiI6Im13aW5kdSIsInVzZXJfcm9sZSI6WyJ1c2VycyIsIm5ldy1uYW1lc3BhY2Utdmlld2VyIl0sImVtYWlsIjoibXdpbmR1QG5vbW9yZWplZGkuY29tIn0 f2As579n9VNoaKzoF dOQGmXkFKf1FMyNV0 va B63jn  n9LGSCca 6IVMP8pO Zb4KvRqGyTP0r3HkHxYy5c81AnIh8ijarruczl TK yF5akjSTHFZD 0gRzlevBDiH8Q79NAr ky0P4iIXS8lY9Vnjch5MF74Zx0c3alKJHJUnnpjIACByfF2SCaYzbWFMUNat K1PaUk5 ujMBG7yYnr95xD 63n8CO8teGUAAEMx6zRjzfhnhbzX ajwZLGwGUBT4WqjMs70 6a7 8gZmLZb2az1cZynkFRj2BaCkVT3A2RrjeEwZEtGXlMqKJ1 I2ulrOVsYx01 yD35 rw get nodes          Webhook Token Authentication  Webhook authentication is a hook for verifying bearer tokens        authentication token webhook config file  a configuration file describing how to access the remote webhook service       authentication token webhook cache ttl  how long to cache authentication decisions  Defaults to two minutes       authentication token webhook version  determines whether to use  authentication k8s io v1beta1  or  authentication k8s io v1     TokenReview  objects to send receive information from the webhook  Defaults to  v1beta1    The configuration file uses the  kubeconfig   docs concepts configuration organize cluster access kubeconfig   file format  Within the file   clusters  refers to the remote service and  users  refers to the API server webhook  An example would be      yaml   Kubernetes API version apiVersion  v1   kind of the API object kind  Config   clusters refers to the remote service  clusters      name  name of remote authn service     cluster        certificate authority   path to ca pem           CA for verifying the remote service        server  https   authn example com authenticate   URL of remote service to query   https  recommended for production     users refers to the API server s webhook configuration  users      name  name of api server     user        client certificate   path to cert pem   cert for the webhook plugin to use       client key   path to key pem            key matching the cert    kubeconfig files require a context  Provide one for the API server  current context  webhook contexts    context      cluster  name of remote authn service     user  name of api server   name  webhook      When a client attempts to authenticate with the API server using a bearer token as discussed  above   putting a bearer token in a request   the authentication webhook POSTs a JSON serialized  TokenReview  object containing the token to the remote service   Note that webhook API objects are subject to the same  versioning compatibility rules   docs concepts overview kubernetes api   as other Kubernetes API objects  Implementers should check the  apiVersion  field of the request to ensure correct deserialization  and   must   respond with a  TokenReview  object of the same version as the request      The Kubernetes API server defaults to sending  authentication k8s io v1beta1  token reviews for backwards compatibility  To opt into receiving  authentication k8s io v1  token reviews  the API server must be started with    authentication token webhook version v1        yaml      apiVersion    authentication k8s io v1      kind    TokenReview      spec           Opaque bearer token sent to the API server      token    014fbff9a07c             Optional list of the audience identifiers for the server the token was presented to        Audience aware token authenticators  for example  OIDC token authenticators        should verify the token was intended for at least one of the audiences in this list        and return the intersection of this list and the valid audiences for the token in the response status        This ensures the token is valid to authenticate to the server it was presented to        If no audiences are provided  the token should be validated to authenticate to the Kubernetes API server       audiences     https   myserver example com    https   myserver internal example com                  yaml      apiVersion    authentication k8s io v1beta1      kind    TokenReview      spec           Opaque bearer token sent to the API server      token    014fbff9a07c             Optional list of the audience identifiers for the server the token was presented to        Audience aware token authenticators  for example  OIDC token authenticators        should verify the token was intended for at least one of the audiences in this list        and return the intersection of this list and the valid audiences for the token in the response status        This ensures the token is valid to authenticate to the server it was presented to        If no audiences are provided  the token should be validated to authenticate to the Kubernetes API server       audiences     https   myserver example com    https   myserver internal example com                The remote service is expected to fill the  status  field of the request to indicate the success of the login  The response body s  spec  field is ignored and may be omitted  The remote service must return a response using the same  TokenReview  API version that it received  A successful validation of the bearer token would return        yaml      apiVersion    authentication k8s io v1      kind    TokenReview      status          authenticated   true       user             Required        username    janedoe example com           Optional        uid    42           Optional group memberships        groups     developers    qa            Optional additional information provided by the authenticator          This should not contain confidential data  as it can be recorded in logs         or API objects  and is made available to admission webhooks         extra              extrafield1                extravalue1              extravalue2                                 Optional list audience aware token authenticators can return        containing the audiences from the  spec audiences  list for which the provided token was valid        If this is omitted  the token is considered to be valid to authenticate to the Kubernetes API server       audiences     https   myserver example com                  yaml      apiVersion    authentication k8s io v1beta1      kind    TokenReview      status          authenticated   true       user             Required        username    janedoe example com           Optional        uid    42           Optional group memberships        groups     developers    qa            Optional additional information provided by the authenticator          This should not contain confidential data  as it can be recorded in logs         or API objects  and is made available to admission webhooks         extra              extrafield1                extravalue1              extravalue2                                 Optional list audience aware token authenticators can return        containing the audiences from the  spec audiences  list for which the provided token was valid        If this is omitted  the token is considered to be valid to authenticate to the Kubernetes API server       audiences     https   myserver example com                An unsuccessful request would return        yaml      apiVersion    authentication k8s io v1      kind    TokenReview      status          authenticated   false        Optionally include details about why authentication failed        If no error is provided  the API will return a generic Unauthorized message        The error field is ignored when authenticated true       error    Credentials are expired                 yaml      apiVersion    authentication k8s io v1beta1      kind    TokenReview      status          authenticated   false        Optionally include details about why authentication failed        If no error is provided  the API will return a generic Unauthorized message        The error field is ignored when authenticated true       error    Credentials are expired                   Authenticating Proxy  The API server can be configured to identify users from request header values  such as  X Remote User   It is designed for use in combination with an authenticating proxy  which sets the request header value        requestheader username headers  Required  case insensitive  Header names to check  in order    for the user identity  The first header containing a value is used as the username       requestheader group headers  1 6   Optional  case insensitive   X Remote Group  is suggested    Header names to check  in order  for the user s groups  All values in all specified headers are used as group names       requestheader extra headers prefix  1 6   Optional  case insensitive   X Remote Extra   is suggested    Header prefixes to look for to determine extra information about the user  typically used by the configured authorization plugin     Any headers beginning with any of the specified prefixes have the prefix removed    The remainder of the header name is lowercased and  percent decoded  https   tools ietf org html rfc3986 section 2 1    and becomes the extra key  and the header value is the extra value    Prior to 1 11 3  and 1 10 7  1 9 11   the extra key could only contain characters which were  legal in HTTP header labels  https   tools ietf org html rfc7230 section 3 2 6     For example  with this configuration         requestheader username headers X Remote User   requestheader group headers X Remote Group   requestheader extra headers prefix X Remote Extra       this request      http GET   HTTP 1 1 X Remote User  fido X Remote Group  dogs X Remote Group  dachshunds X Remote Extra Acme com 2Fproject  some project X Remote Extra Scopes  openid X Remote Extra Scopes  profile      would result in this user info      yaml name  fido groups    dogs   dachshunds extra    acme com project      some project   scopes      openid     profile      In order to prevent header spoofing  the authenticating proxy is required to present a valid client certificate to the API server for validation against the specified CA before the request headers are checked  WARNING  do   not   reuse a CA that is used in a different context unless you understand the risks and the mechanisms to protect the CA s usage        requestheader client ca file  Required  PEM encoded certificate bundle  A valid client certificate   must be presented and validated against the certificate authorities in the specified file before the   request headers are checked for user names       requestheader allowed names  Optional  List of Common Name values  CNs   If set  a valid client   certificate with a CN in the specified list must be presented before the request headers are checked   for user names  If empty  any CN is allowed      Anonymous requests  When enabled  requests that are not rejected by other configured authentication methods are treated as anonymous requests  and given a username of  system anonymous  and a group of  system unauthenticated    For example  on a server with token authentication configured  and anonymous access enabled  a request providing an invalid bearer token would receive a  401 Unauthorized  error  A request providing no bearer token would be treated as an anonymous request   In 1 5 1 1 5 x  anonymous access is disabled by default  and can be enabled by passing the    anonymous auth true  option to the API server   In 1 6   anonymous access is enabled by default if an authorization mode other than  AlwaysAllow  is used  and can be disabled by passing the    anonymous auth false  option to the API server  Starting in 1 6  the ABAC and RBAC authorizers require explicit authorization of the  system anonymous  user or the  system unauthenticated  group  so legacy policy rules that grant access to the     user or     group do not include anonymous users       Anonymous Authenticator Configuration    The  AuthenticationConfiguration  can be used to configure the anonymous authenticator  To enable configuring anonymous auth via the config file you need enable the  AnonymousAuthConfigurableEndpoints  feature gate  When this feature gate is enabled you cannot set the    anonymous auth  flag   The main advantage of configuring anonymous authenticator using the authentication configuration file is that in addition to enabling and disabling anonymous authentication you can also configure which endpoints support anonymous authentication   A sample authentication configuration file is below      yaml         CAUTION  this is an example configuration             Do not use this for your own cluster    apiVersion  apiserver config k8s io v1beta1 kind  AuthenticationConfiguration anonymous    enabled  true   conditions      path   livez     path   readyz     path   healthz      In the configuration above only the   livez     readyz  and   healthz  endpoints are reachable by anonymous requests  Any other endpoints will not be reachable even if it is allowed by RBAC configuration      User impersonation  A user can act as another user through impersonation headers  These let requests manually override the user info a request authenticates as  For example  an admin could use this feature to debug an authorization policy by temporarily impersonating another user and seeing if a request was denied   Impersonation requests first authenticate as the requesting user  then switch to the impersonated user info     A user makes an API call with their credentials  and  impersonation headers    API server authenticates the user    API server ensures the authenticated users have impersonation privileges    Request user info is replaced with impersonation values    Request is evaluated  authorization acts on impersonated user info   The following HTTP headers can be used to performing an impersonation request      Impersonate User   The username to act as     Impersonate Group   A group name to act as  Can be provided multiple times to set multiple groups    Optional  Requires  Impersonate User      Impersonate Extra   extra name     A dynamic header used to associate extra fields with the user    Optional  Requires  Impersonate User   In order to be preserved consistently     extra name      must be lower case  and any characters which aren t  legal in HTTP header labels  https   tools ietf org html rfc7230 section 3 2 6    MUST be utf8 and  percent encoded  https   tools ietf org html rfc3986 section 2 1      Impersonate Uid   A unique identifier that represents the user being impersonated  Optional    Requires  Impersonate User   Kubernetes does not impose any format requirements on this string    Prior to 1 11 3  and 1 10 7  1 9 11      extra name    could only contain characters which were  legal in HTTP header labels  https   tools ietf org html rfc7230 section 3 2 6       Impersonate Uid  is only available in versions 1 22 0 and higher    An example of the impersonation headers used when impersonating a user with groups      http Impersonate User  jane doe example com Impersonate Group  developers Impersonate Group  admins      An example of the impersonation headers used when impersonating a user with a UID and extra fields      http Impersonate User  jane doe example com Impersonate Extra dn  cn jane ou engineers dc example dc com Impersonate Extra acme com 2Fproject  some project Impersonate Extra scopes  view Impersonate Extra scopes  development Impersonate Uid  06f6ce97 e2c5 4ab8 7ba5 7654dd08d52b      When using  kubectl  set the    as  flag to configure the  Impersonate User  header  set the    as group  flag to configure the  Impersonate Group  header      bash kubectl drain mynode         none Error from server  Forbidden   User  clark  cannot get nodes at the cluster scope   get nodes mynode       Set the    as  and    as group  flag      bash kubectl drain mynode   as superman   as group system masters         none node mynode cordoned node mynode drained        kubectl  cannot impersonate extra fields or UIDs    To impersonate a user  group  user identifier  UID  or extra fields  the impersonating user must have the ability to perform the  impersonate  verb on the kind of attribute being impersonated   user    group    uid   etc    For clusters that enable the RBAC authorization plugin  the following ClusterRole encompasses the rules needed to set user and group impersonation headers      yaml apiVersion  rbac authorization k8s io v1 kind  ClusterRole metadata    name  impersonator rules    apiGroups         resources    users    groups    serviceaccounts     verbs    impersonate        For impersonation  extra fields and impersonated UIDs are both under the  authentication k8s io   apiGroup   Extra fields are evaluated as sub resources of the resource  userextras   To allow a user to use impersonation headers for the extra field  scopes  and for UIDs  a user should be granted the following role      yaml apiVersion  rbac authorization k8s io v1 kind  ClusterRole metadata    name  scopes and uid impersonator rules    Can set  Impersonate Extra scopes  header and the  Impersonate Uid  header    apiGroups    authentication k8s io     resources    userextras scopes    uids     verbs    impersonate        The values of impersonation headers can also be restricted by limiting the set of  resourceNames  a resource can take      yaml apiVersion  rbac authorization k8s io v1 kind  ClusterRole metadata    name  limited impersonator rules    Can impersonate the user  jane doe example com    apiGroups         resources    users     verbs    impersonate     resourceNames    jane doe example com      Can impersonate the groups  developers  and  admins    apiGroups         resources    groups     verbs    impersonate     resourceNames    developers   admins      Can impersonate the extras field  scopes  with the values  view  and  development    apiGroups    authentication k8s io     resources    userextras scopes     verbs    impersonate     resourceNames    view    development      Can impersonate the uid  06f6ce97 e2c5 4ab8 7ba5 7654dd08d52b    apiGroups    authentication k8s io     resources    uids     verbs    impersonate     resourceNames    06f6ce97 e2c5 4ab8 7ba5 7654dd08d52b         Impersonating a user or group allows you to perform any action as if you were that user or group  for that reason  impersonation is not namespace scoped  If you want to allow impersonation using Kubernetes RBAC  this requires using a  ClusterRole  and a  ClusterRoleBinding   not a  Role  and  RoleBinding        client go credential plugins     k8s io client go  and tools using it such as  kubectl  and  kubelet  are able to execute an external command to receive user credentials   This feature is intended for client side integrations with authentication protocols not natively supported by  k8s io client go   LDAP  Kerberos  OAuth2  SAML  etc    The plugin implements the protocol specific logic  then returns opaque credentials to use  Almost all credential plugin use cases require a server side component with support for the  webhook token authenticator   webhook token authentication  to interpret the credential format produced by the client plugin    Earlier versions of  kubectl  included built in support for authenticating to AKS and GKE  but this is no longer present        Example use case  In a hypothetical use case  an organization would run an external service that exchanges LDAP credentials for user specific  signed tokens  The service would also be capable of responding to  webhook token authenticator   webhook token authentication  requests to validate the tokens  Users would be required to install a credential plugin on their workstation   To authenticate against the API     The user issues a  kubectl  command    Credential plugin prompts the user for LDAP credentials  exchanges credentials with external service for a token    Credential plugin returns token to client go  which uses it as a bearer token against the API server    API server uses the  webhook token authenticator   webhook token authentication  to submit a  TokenReview  to the external service    External service verifies the signature on the token and returns the user s username and groups       Configuration  Credential plugins are configured through  kubectl config files   docs tasks access application cluster configure access multiple clusters   as part of the user fields        yaml apiVersion  v1 kind  Config users    name  my user   user      exec          Command to execute  Required        command   example client go exec plugin           API version to use when decoding the ExecCredentials resource  Required                  The API version returned by the plugin MUST match the version listed here                  To integrate with tools that support multiple versions  such as client authentication k8s io v1beta1           set an environment variable  pass an argument to the tool that indicates which version the exec plugin expects          or read the version from the ExecCredential object in the KUBERNETES EXEC INFO environment variable        apiVersion   client authentication k8s io v1           Environment variables to set when executing the plugin  Optional        env          name   FOO          value   bar           Arguments to pass when executing the plugin  Optional        args           arg1           arg2           Text shown to the user when the executable doesn t seem to be present  Optional        installHint            example client go exec plugin is required to authenticate         to the current cluster   It can be installed           On macOS  brew install example client go exec plugin          On Ubuntu  apt get install example client go exec plugin          On Fedora  dnf install example client go exec plugin                       Whether or not to provide cluster information  which could potentially contain         very large CA data  to this exec plugin as a part of the KUBERNETES EXEC INFO         environment variable        provideClusterInfo  true          The contract between the exec plugin and the standard input I O stream  If the         contract cannot be satisfied  this plugin will not be run and an error will be         returned  Valid values are  Never   this exec plugin never uses standard input            IfAvailable   this exec plugin wants to use standard input if it is available           or  Always   this exec plugin requires standard input to function   Required        interactiveMode  Never clusters    name  my cluster   cluster      server   https   172 17 4 100 6443      certificate authority    etc kubernetes ca pem      extensions        name  client authentication k8s io exec   reserved extension name for per cluster exec config       extension          arbitrary  config         this  can be provided via the KUBERNETES EXEC INFO environment variable upon setting provideClusterInfo         you    can    put    anything    here   contexts    name  my cluster   context      cluster  my cluster     user  my user current context  my cluster          yaml apiVersion  v1 kind  Config users    name  my user   user      exec          Command to execute  Required        command   example client go exec plugin           API version to use when decoding the ExecCredentials resource  Required                  The API version returned by the plugin MUST match the version listed here                  To integrate with tools that support multiple versions  such as client authentication k8s io v1           set an environment variable  pass an argument to the tool that indicates which version the exec plugin expects          or read the version from the ExecCredential object in the KUBERNETES EXEC INFO environment variable        apiVersion   client authentication k8s io v1beta1           Environment variables to set when executing the plugin  Optional        env          name   FOO          value   bar           Arguments to pass when executing the plugin  Optional        args           arg1           arg2           Text shown to the user when the executable doesn t seem to be present  Optional        installHint            example client go exec plugin is required to authenticate         to the current cluster   It can be installed           On macOS  brew install example client go exec plugin          On Ubuntu  apt get install example client go exec plugin          On Fedora  dnf install example client go exec plugin                       Whether or not to provide cluster information  which could potentially contain         very large CA data  to this exec plugin as a part of the KUBERNETES EXEC INFO         environment variable        provideClusterInfo  true          The contract between the exec plugin and the standard input I O stream  If the         contract cannot be satisfied  this plugin will not be run and an error will be         returned  Valid values are  Never   this exec plugin never uses standard input            IfAvailable   this exec plugin wants to use standard input if it is available           or  Always   this exec plugin requires standard input to function   Optional          Defaults to  IfAvailable         interactiveMode  Never clusters    name  my cluster   cluster      server   https   172 17 4 100 6443      certificate authority    etc kubernetes ca pem      extensions        name  client authentication k8s io exec   reserved extension name for per cluster exec config       extension          arbitrary  config         this  can be provided via the KUBERNETES EXEC INFO environment variable upon setting provideClusterInfo         you    can    put    anything    here   contexts    name  my cluster   context      cluster  my cluster     user  my user current context  my cluster        Relative command paths are interpreted as relative to the directory of the config file  If KUBECONFIG is set to   home jane kubeconfig  and the exec command is    bin example client go exec plugin   the binary   home jane bin example client go exec plugin  is executed      yaml   name  my user   user      exec          Path relative to the directory of the kubeconfig       command     bin example client go exec plugin        apiVersion   client authentication k8s io v1        interactiveMode  Never          Input and output formats  The executed command prints an  ExecCredential  object to  stdout    k8s io client go  authenticates against the Kubernetes API using the returned credentials in the  status   The executed command is passed an  ExecCredential  object as input via the  KUBERNETES EXEC INFO  environment variable  This input contains helpful information like the expected API version of the returned  ExecCredential  object and whether or not the plugin can use  stdin  to interact with the user   When run from an interactive session  i e   a terminal    stdin  can be exposed directly to the plugin  Plugins should use the  spec interactive  field of the input  ExecCredential  object from the  KUBERNETES EXEC INFO  environment variable in order to determine if  stdin  has been provided  A plugin s  stdin  requirements  i e   whether  stdin  is optional  strictly required  or never used in order for the plugin to run successfully  is declared via the  user exec interactiveMode  field in the  kubeconfig   docs concepts configuration organize cluster access kubeconfig    see table below for valid values   The  user exec interactiveMode  field is optional in  client authentication k8s io v1beta1  and required in  client authentication k8s io v1        interactiveMode  Value   Meaning                                            Never    This exec plugin never needs to use standard input  and therefore the exec plugin will be run regardless of whether standard input is available for user input       IfAvailable    This exec plugin would like to use standard input if it is available  but can still operate if standard input is not available  Therefore  the exec plugin will be run regardless of whether stdin is available for user input  If standard input is available for user input  then it will be provided to this exec plugin       Always    This exec plugin requires standard input in order to run  and therefore the exec plugin will only be run if standard input is available for user input  If standard input is not available for user input  then the exec plugin will not be run and an error will be returned by the exec plugin runner      To use bearer token credentials  the plugin returns a token in the status of the   ExecCredential    docs reference config api client authentication v1beta1  client authentication k8s io v1beta1 ExecCredential        json      apiVersion    client authentication k8s io v1      kind    ExecCredential      status          token    my bearer token                 json      apiVersion    client authentication k8s io v1beta1      kind    ExecCredential      status          token    my bearer token               Alternatively  a PEM encoded client certificate and key can be returned to use TLS client auth  If the plugin returns a different certificate and key on a subsequent call   k8s io client go  will close existing connections with the server to force a new TLS handshake   If specified   clientKeyData  and  clientCertificateData  must both must be present    clientCertificateData  may contain additional intermediate certificates to send to the server        json      apiVersion    client authentication k8s io v1      kind    ExecCredential      status          clientCertificateData         BEGIN CERTIFICATE      n    n     END CERTIFICATE             clientKeyData         BEGIN RSA PRIVATE KEY      n    n     END RSA PRIVATE KEY                      json      apiVersion    client authentication k8s io v1beta1      kind    ExecCredential      status          clientCertificateData         BEGIN CERTIFICATE      n    n     END CERTIFICATE             clientKeyData         BEGIN RSA PRIVATE KEY      n    n     END RSA PRIVATE KEY                    Optionally  the response can include the expiry of the credential formatted as a  RFC 3339  https   datatracker ietf org doc html rfc3339  timestamp   Presence or absence of an expiry has the following impact     If an expiry is included  the bearer token and TLS credentials are cached until   the expiry time is reached  or if the server responds with a 401 HTTP status code    or when the process exits    If an expiry is omitted  the bearer token and TLS credentials are cached until   the server responds with a 401 HTTP status code or until the process exits        json      apiVersion    client authentication k8s io v1      kind    ExecCredential      status          token    my bearer token        expirationTimestamp    2018 03 05T17 30 20 08 00                 json      apiVersion    client authentication k8s io v1beta1      kind    ExecCredential      status          token    my bearer token        expirationTimestamp    2018 03 05T17 30 20 08 00               To enable the exec plugin to obtain cluster specific information  set  provideClusterInfo  on the  user exec  field in the  kubeconfig   docs concepts configuration organize cluster access kubeconfig    The plugin will then be supplied this cluster specific information in the  KUBERNETES EXEC INFO  environment variable  Information from this environment variable can be used to perform cluster specific credential acquisition logic  The following  ExecCredential  manifest describes a cluster information sample        json      apiVersion    client authentication k8s io v1      kind    ExecCredential      spec          cluster            server    https   172 17 4 100 6443          certificate authority data    LS0t             config              arbitrary    config            this    can be provided via the KUBERNETES EXEC INFO environment variable upon setting provideClusterInfo            you     can    put    anything    here                       interactive   true                json      apiVersion    client authentication k8s io v1beta1      kind    ExecCredential      spec          cluster            server    https   172 17 4 100 6443          certificate authority data    LS0t             config              arbitrary    config            this    can be provided via the KUBERNETES EXEC INFO environment variable upon setting provideClusterInfo            you     can    put    anything    here                       interactive   true                 API access to authentication information for a client   self subject review     If your cluster has the API enabled  you can use the  SelfSubjectReview  API to find out how your Kubernetes cluster maps your authentication information to identify you as a client  This works whether you are authenticating as a user  typically representing a real person  or as a ServiceAccount    SelfSubjectReview  objects do not have any configurable fields  On receiving a request  the Kubernetes API server fills the status with the user attributes and returns it to the user   Request example  the body would be a  SelfSubjectReview        http POST  apis authentication k8s io v1 selfsubjectreviews         json      apiVersion    authentication k8s io v1      kind    SelfSubjectReview         Response example      json      apiVersion    authentication k8s io v1      kind    SelfSubjectReview      status          userInfo            name    jane doe          uid    b6c7cfd4 f166 11ec 8ea0 0242ac120002          groups              viewers            editors            system authenticated                  extra              provider id     token company example                            For convenience  the  kubectl auth whoami  command is present  Executing this command will produce the following output  yet different user attributes will be shown      Simple output example          ATTRIBUTE         VALUE   Username          jane doe   Groups             system authenticated           Complex example including extra attributes          ATTRIBUTE         VALUE   Username          jane doe   UID               b79dbf30 0c6a 11ed 861d 0242ac120002   Groups             students teachers system authenticated    Extra  skills      reading learning    Extra  subjects    math sports         By providing the output flag  it is also possible to print the JSON or YAML representation of the result        json      apiVersion    authentication k8s io v1      kind    SelfSubjectReview      status          userInfo            username    jane doe          uid    b79dbf30 0c6a 11ed 861d 0242ac120002          groups              students            teachers            system authenticated                  extra              skills                reading              learning                      subjects                math              sports                                          yaml apiVersion  authentication k8s io v1 kind  SelfSubjectReview status    userInfo      username  jane doe     uid  b79dbf30 0c6a 11ed 861d 0242ac120002     groups        students       teachers       system authenticated     extra        skills          reading         learning       subjects          math         sports        This feature is extremely useful when a complicated authentication flow is used in a Kubernetes cluster  for example  if you use  webhook token authentication   docs reference access authn authz authentication  webhook token authentication  or  authenticating proxy   docs reference access authn authz authentication  authenticating proxy     The Kubernetes API server fills the  userInfo  after all authentication mechanisms are applied  including  impersonation   docs reference access authn authz authentication  user impersonation   If you  or an authentication proxy  make a SelfSubjectReview using impersonation  you see the user details and properties for the user that was impersonated    By default  all authenticated users can create  SelfSubjectReview  objects when the  APISelfSubjectReview  feature is enabled  It is allowed by the  system basic user  cluster role    You can only make  SelfSubjectReview  requests if     the  APISelfSubjectReview     feature gate   docs reference command line tools reference feature gates     is enabled for your cluster  not needed for Kubernetes   but older   Kubernetes versions might not offer this feature gate  or might default it to be off     if you are running a version of Kubernetes older than v1 28  the API server for your   cluster has the  authentication k8s io v1alpha1  or  authentication k8s io v1beta1       enabled           Read the  client authentication reference  v1beta1    docs reference config api client authentication v1beta1     Read the  client authentication reference  v1    docs reference config api client authentication v1