kubernetes reference autogenerated true import k8s io api certificates v1alpha1 weight 5 apiVersion certificates k8s io v1alpha1 contenttype apireference ClusterTrustBundle is a cluster scoped container for X apimetadata title ClusterTrustBundle v1alpha1 kind ClusterTrustBundle

Answer:
---
api_metadata:
  apiVersion: "certificates.k8s.io/v1alpha1"
  import: "k8s.io/api/certificates/v1alpha1"
  kind: "ClusterTrustBundle"
content_type: "api_reference"
description: "ClusterTrustBundle is a cluster-scoped container for X."
title: "ClusterTrustBundle v1alpha1"
weight: 5
auto_generated: true
---

`apiVersion: certificates.k8s.io/v1alpha1`

`import "k8s.io/api/certificates/v1alpha1"`

## ClusterTrustBundle {#ClusterTrustBundle}

ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).

ClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster, because they can be mounted by pods using the `clusterTrustBundle` projection.  All service accounts have read access to ClusterTrustBundles by default.  Users who only have namespace-level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to.

It can be optionally associated with a particular assigner, in which case it contains one valid set of trust anchors for that signer. Signers may have multiple associated ClusterTrustBundles; each is an independent set of trust anchors for that signer. Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle.

- **apiVersion**: certificates.k8s.io/v1alpha1

- **kind**: ClusterTrustBundle

- **metadata** (ObjectMeta)

  metadata contains the object metadata.

- **spec** (ClusterTrustBundleSpec), required

  spec contains the signer (if any) and trust anchors.

## ClusterTrustBundleSpec {#ClusterTrustBundleSpec}

ClusterTrustBundleSpec contains the signer and trust anchors.

- **trustBundle** (string), required

  trustBundle contains the individual X.509 trust anchors for this bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.

  The data must consist only of PEM certificate blocks that parse as valid X.509 certificates.  Each certificate must include a basic constraints extension with the CA bit set.  The API server will reject objects that contain duplicate certificates, or that use PEM block headers.

  Users of ClusterTrustBundles, including Kubelet, are free to reorder and deduplicate certificate blocks in this file according to their own logic, as well as to drop PEM block headers and inter-block data.

- **signerName** (string)

  signerName indicates the associated signer, if any.

  In order to create or update a ClusterTrustBundle that sets signerName, you must have the following cluster-scoped permission: group=certificates.k8s.io resource=signers resourceName=\<the signer name> verb=attest.

  If signerName is not empty, then the ClusterTrustBundle object must be named with the signer name as a prefix (translating slashes to colons). For example, for the signer name `example.com/foo`, valid ClusterTrustBundle object names include `example.com:foo:abc` and `example.com:foo:v1`.

  If signerName is empty, then the ClusterTrustBundle object's name must not have such a prefix.

  List/watch requests for ClusterTrustBundles can filter on this field using a `spec.signerName=NAME` field selector.

## ClusterTrustBundleList {#ClusterTrustBundleList}

ClusterTrustBundleList is a collection of ClusterTrustBundle objects

- **apiVersion**: certificates.k8s.io/v1alpha1

- **kind**: ClusterTrustBundleList

- **metadata** (ListMeta)

  metadata contains the list metadata.

- **items** ([]ClusterTrustBundle), required

  items is a collection of ClusterTrustBundle objects

## Operations {#Operations}

### `get` read the specified ClusterTrustBundle

#### HTTP Request

GET /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterTrustBundle

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterTrustBundle): OK

401: Unauthorized

### `list` list or watch objects of kind ClusterTrustBundle

#### HTTP Request

GET /apis/certificates.k8s.io/v1alpha1/clustertrustbundles

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (ClusterTrustBundleList): OK

401: Unauthorized

### `create` create a ClusterTrustBundle

#### HTTP Request

POST /apis/certificates.k8s.io/v1alpha1/clustertrustbundles

#### Parameters

- **body**: ClusterTrustBundle, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterTrustBundle): OK

201 (ClusterTrustBundle): Created

202 (ClusterTrustBundle): Accepted

401: Unauthorized

### `update` replace the specified ClusterTrustBundle

#### HTTP Request

PUT /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterTrustBundle

- **body**: ClusterTrustBundle, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterTrustBundle): OK

201 (ClusterTrustBundle): Created

401: Unauthorized

### `patch` partially update the specified ClusterTrustBundle

#### HTTP Request

PATCH /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterTrustBundle

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (ClusterTrustBundle): OK

201 (ClusterTrustBundle): Created

401: Unauthorized

### `delete` delete a ClusterTrustBundle

#### HTTP Request

DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ClusterTrustBundle

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of ClusterTrustBundle

#### HTTP Request

DELETE /apis/certificates.k8s.io/v1alpha1/clustertrustbundles

#### Parameters

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   certificates k8s io v1alpha1    import   k8s io api certificates v1alpha1    kind   ClusterTrustBundle  content type   api reference  description   ClusterTrustBundle is a cluster scoped container for X   title   ClusterTrustBundle v1alpha1  weight  5 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  certificates k8s io v1alpha1    import  k8s io api certificates v1alpha1        ClusterTrustBundle   ClusterTrustBundle   ClusterTrustBundle is a cluster scoped container for X 509 trust anchors  root certificates    ClusterTrustBundle objects are considered to be readable by any authenticated user in the cluster  because they can be mounted by pods using the  clusterTrustBundle  projection   All service accounts have read access to ClusterTrustBundles by default   Users who only have namespace level access to a cluster can read ClusterTrustBundles by impersonating a serviceaccount that they have access to   It can be optionally associated with a particular assigner  in which case it contains one valid set of trust anchors for that signer  Signers may have multiple associated ClusterTrustBundles  each is an independent set of trust anchors for that signer  Admission control is used to enforce that only users with permissions on the signer can create or modify the corresponding bundle    hr       apiVersion    certificates k8s io v1alpha1       kind    ClusterTrustBundle       metadata     a href    ObjectMeta  a      metadata contains the object metadata       spec     a href    ClusterTrustBundleSpec  a    required    spec contains the signer  if any  and trust anchors          ClusterTrustBundleSpec   ClusterTrustBundleSpec   ClusterTrustBundleSpec contains the signer and trust anchors    hr       trustBundle    string   required    trustBundle contains the individual X 509 trust anchors for this bundle  as PEM bundle of PEM wrapped  DER formatted X 509 certificates       The data must consist only of PEM certificate blocks that parse as valid X 509 certificates   Each certificate must include a basic constraints extension with the CA bit set   The API server will reject objects that contain duplicate certificates  or that use PEM block headers       Users of ClusterTrustBundles  including Kubelet  are free to reorder and deduplicate certificate blocks in this file according to their own logic  as well as to drop PEM block headers and inter block data       signerName    string     signerName indicates the associated signer  if any       In order to create or update a ClusterTrustBundle that sets signerName  you must have the following cluster scoped permission  group certificates k8s io resource signers resourceName   the signer name  verb attest       If signerName is not empty  then the ClusterTrustBundle object must be named with the signer name as a prefix  translating slashes to colons   For example  for the signer name  example com foo   valid ClusterTrustBundle object names include  example com foo abc  and  example com foo v1        If signerName is empty  then the ClusterTrustBundle object s name must not have such a prefix       List watch requests for ClusterTrustBundles can filter on this field using a  spec signerName NAME  field selector          ClusterTrustBundleList   ClusterTrustBundleList   ClusterTrustBundleList is a collection of ClusterTrustBundle objects   hr       apiVersion    certificates k8s io v1alpha1       kind    ClusterTrustBundleList       metadata     a href    ListMeta  a      metadata contains the list metadata       items       a href    ClusterTrustBundle  a    required    items is a collection of ClusterTrustBundle objects         Operations   Operations      hr             get  read the specified ClusterTrustBundle       HTTP Request  GET  apis certificates k8s io v1alpha1 clustertrustbundles  name        Parameters       name     in path    string  required    name of the ClusterTrustBundle       pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterTrustBundle  a    OK  401  Unauthorized        list  list or watch objects of kind ClusterTrustBundle       HTTP Request  GET  apis certificates k8s io v1alpha1 clustertrustbundles       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    ClusterTrustBundleList  a    OK  401  Unauthorized        create  create a ClusterTrustBundle       HTTP Request  POST  apis certificates k8s io v1alpha1 clustertrustbundles       Parameters       body     a href    ClusterTrustBundle  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterTrustBundle  a    OK  201   a href    ClusterTrustBundle  a    Created  202   a href    ClusterTrustBundle  a    Accepted  401  Unauthorized        update  replace the specified ClusterTrustBundle       HTTP Request  PUT  apis certificates k8s io v1alpha1 clustertrustbundles  name        Parameters       name     in path    string  required    name of the ClusterTrustBundle       body     a href    ClusterTrustBundle  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterTrustBundle  a    OK  201   a href    ClusterTrustBundle  a    Created  401  Unauthorized        patch  partially update the specified ClusterTrustBundle       HTTP Request  PATCH  apis certificates k8s io v1alpha1 clustertrustbundles  name        Parameters       name     in path    string  required    name of the ClusterTrustBundle       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ClusterTrustBundle  a    OK  201   a href    ClusterTrustBundle  a    Created  401  Unauthorized        delete  delete a ClusterTrustBundle       HTTP Request  DELETE  apis certificates k8s io v1alpha1 clustertrustbundles  name        Parameters       name     in path    string  required    name of the ClusterTrustBundle       body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of ClusterTrustBundle       HTTP Request  DELETE  apis certificates k8s io v1alpha1 clustertrustbundles       Parameters       body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference ServiceAccount binds together a name understood by users and perhaps by peripheral systems for an identity a principal that can be authenticated and authorized a set of secrets apiVersion v1 kind ServiceAccount contenttype apireference apimetadata title ServiceAccount autogenerated true weight 1 import k8s io api core v1

Answer:
---
api_metadata:
  apiVersion: "v1"
  import: "k8s.io/api/core/v1"
  kind: "ServiceAccount"
content_type: "api_reference"
description: "ServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets."
title: "ServiceAccount"
weight: 1
auto_generated: true
---

`apiVersion: v1`

`import "k8s.io/api/core/v1"`

## ServiceAccount {#ServiceAccount}

ServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets

- **apiVersion**: v1

- **kind**: ServiceAccount

- **metadata** (ObjectMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **automountServiceAccountToken** (boolean)

  AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.

- **imagePullSecrets** ([]LocalObjectReference)

  *Atomic: will be replaced during a merge*

  ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod

- **secrets** ([]ObjectReference)

  *Patch strategy: merge on key `name`*

  *Map: unique values on key name will be kept during a merge*

  Secrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secret

## ServiceAccountList {#ServiceAccountList}

ServiceAccountList is a list of ServiceAccount objects

- **apiVersion**: v1

- **kind**: ServiceAccountList

- **metadata** (ListMeta)

  Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

- **items** ([]ServiceAccount), required

  List of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

## Operations {#Operations}

### `get` read the specified ServiceAccount

#### HTTP Request

GET /api/v1/namespaces/{namespace}/serviceaccounts/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ServiceAccount

- **namespace** (*in path*): string, required

  namespace

- **pretty** (*in query*): string

  pretty

#### Response

200 (ServiceAccount): OK

401: Unauthorized

### `list` list or watch objects of kind ServiceAccount

#### HTTP Request

GET /api/v1/namespaces/{namespace}/serviceaccounts

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (ServiceAccountList): OK

401: Unauthorized

### `list` list or watch objects of kind ServiceAccount

#### HTTP Request

GET /api/v1/serviceaccounts

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (ServiceAccountList): OK

401: Unauthorized

### `create` create a ServiceAccount

#### HTTP Request

POST /api/v1/namespaces/{namespace}/serviceaccounts

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: ServiceAccount, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ServiceAccount): OK

201 (ServiceAccount): Created

202 (ServiceAccount): Accepted

401: Unauthorized

### `update` replace the specified ServiceAccount

#### HTTP Request

PUT /api/v1/namespaces/{namespace}/serviceaccounts/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ServiceAccount

- **namespace** (*in path*): string, required

  namespace

- **body**: ServiceAccount, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (ServiceAccount): OK

201 (ServiceAccount): Created

401: Unauthorized

### `patch` partially update the specified ServiceAccount

#### HTTP Request

PATCH /api/v1/namespaces/{namespace}/serviceaccounts/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ServiceAccount

- **namespace** (*in path*): string, required

  namespace

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (ServiceAccount): OK

201 (ServiceAccount): Created

401: Unauthorized

### `delete` delete a ServiceAccount

#### HTTP Request

DELETE /api/v1/namespaces/{namespace}/serviceaccounts/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the ServiceAccount

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (ServiceAccount): OK

202 (ServiceAccount): Accepted

401: Unauthorized

### `deletecollection` delete collection of ServiceAccount

#### HTTP Request

DELETE /api/v1/namespaces/{namespace}/serviceaccounts

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   v1    import   k8s io api core v1    kind   ServiceAccount  content type   api reference  description   ServiceAccount binds together    a name  understood by users  and perhaps by peripheral systems  for an identity   a principal that can be authenticated and authorized   a set of secrets   title   ServiceAccount  weight  1 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  v1    import  k8s io api core v1        ServiceAccount   ServiceAccount   ServiceAccount binds together    a name  understood by users  and perhaps by peripheral systems  for an identity   a principal that can be authenticated and authorized   a set of secrets   hr       apiVersion    v1       kind    ServiceAccount       metadata     a href    ObjectMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      automountServiceAccountToken    boolean     AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted  Can be overridden at the pod level       imagePullSecrets       a href    LocalObjectReference  a       Atomic  will be replaced during a merge       ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount  ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod  but ImagePullSecrets are only accessed by the kubelet  More info  https   kubernetes io docs concepts containers images  specifying imagepullsecrets on a pod      secrets       a href    ObjectReference  a       Patch strategy  merge on key  name         Map  unique values on key name will be kept during a merge       Secrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use  Pods are only limited to this list if this service account has a  kubernetes io enforce mountable secrets  annotation set to  true   This field should not be used to find auto generated service account token secrets for use outside of pods  Instead  tokens can be requested directly using the TokenRequest API  or service account token secrets can be manually created  More info  https   kubernetes io docs concepts configuration secret         ServiceAccountList   ServiceAccountList   ServiceAccountList is a list of ServiceAccount objects   hr       apiVersion    v1       kind    ServiceAccountList       metadata     a href    ListMeta  a      Standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md types kinds      items       a href    ServiceAccount  a    required    List of ServiceAccounts  More info  https   kubernetes io docs tasks configure pod container configure service account          Operations   Operations      hr             get  read the specified ServiceAccount       HTTP Request  GET  api v1 namespaces  namespace  serviceaccounts  name        Parameters       name     in path    string  required    name of the ServiceAccount       namespace     in path    string  required     a href    namespace  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ServiceAccount  a    OK  401  Unauthorized        list  list or watch objects of kind ServiceAccount       HTTP Request  GET  api v1 namespaces  namespace  serviceaccounts       Parameters       namespace     in path    string  required     a href    namespace  a        allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    ServiceAccountList  a    OK  401  Unauthorized        list  list or watch objects of kind ServiceAccount       HTTP Request  GET  api v1 serviceaccounts       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    ServiceAccountList  a    OK  401  Unauthorized        create  create a ServiceAccount       HTTP Request  POST  api v1 namespaces  namespace  serviceaccounts       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    ServiceAccount  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ServiceAccount  a    OK  201   a href    ServiceAccount  a    Created  202   a href    ServiceAccount  a    Accepted  401  Unauthorized        update  replace the specified ServiceAccount       HTTP Request  PUT  api v1 namespaces  namespace  serviceaccounts  name        Parameters       name     in path    string  required    name of the ServiceAccount       namespace     in path    string  required     a href    namespace  a        body     a href    ServiceAccount  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ServiceAccount  a    OK  201   a href    ServiceAccount  a    Created  401  Unauthorized        patch  partially update the specified ServiceAccount       HTTP Request  PATCH  api v1 namespaces  namespace  serviceaccounts  name        Parameters       name     in path    string  required    name of the ServiceAccount       namespace     in path    string  required     a href    namespace  a        body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    ServiceAccount  a    OK  201   a href    ServiceAccount  a    Created  401  Unauthorized        delete  delete a ServiceAccount       HTTP Request  DELETE  api v1 namespaces  namespace  serviceaccounts  name        Parameters       name     in path    string  required    name of the ServiceAccount       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    ServiceAccount  a    OK  202   a href    ServiceAccount  a    Accepted  401  Unauthorized        deletecollection  delete collection of ServiceAccount       HTTP Request  DELETE  api v1 namespaces  namespace  serviceaccounts       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference TokenRequest requests a token for a given service account weight 2 title TokenRequest contenttype apireference import k8s io api authentication v1 apimetadata apiVersion authentication k8s io v1 autogenerated true kind TokenRequest

Answer:
---
api_metadata:
  apiVersion: "authentication.k8s.io/v1"
  import: "k8s.io/api/authentication/v1"
  kind: "TokenRequest"
content_type: "api_reference"
description: "TokenRequest requests a token for a given service account."
title: "TokenRequest"
weight: 2
auto_generated: true
---

`apiVersion: authentication.k8s.io/v1`

`import "k8s.io/api/authentication/v1"`

## TokenRequest {#TokenRequest}

TokenRequest requests a token for a given service account.

- **apiVersion**: authentication.k8s.io/v1

- **kind**: TokenRequest

- **metadata** (ObjectMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (TokenRequestSpec), required

  Spec holds information about the request being evaluated

- **status** (TokenRequestStatus)

  Status is filled in by the server and indicates whether the token can be authenticated.

## TokenRequestSpec {#TokenRequestSpec}

TokenRequestSpec contains client provided parameters of a token request.

- **audiences** ([]string), required

  *Atomic: will be replaced during a merge*

  Audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.

- **boundObjectRef** (BoundObjectReference)

  BoundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.

  *BoundObjectReference is a reference to an object that a token is bound to.*

  - **boundObjectRef.apiVersion** (string)

    API version of the referent.

  - **boundObjectRef.kind** (string)

    Kind of the referent. Valid kinds are 'Pod' and 'Secret'.

  - **boundObjectRef.name** (string)

    Name of the referent.

  - **boundObjectRef.uid** (string)

    UID of the referent.

- **expirationSeconds** (int64)

  ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.

## TokenRequestStatus {#TokenRequestStatus}

TokenRequestStatus is the result of a token request.

- **expirationTimestamp** (Time), required

  ExpirationTimestamp is the time of expiration of the returned token.

  *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.*

- **token** (string), required

  Token is the opaque bearer token.

## Operations {#Operations}

### `create` create token of a ServiceAccount

#### HTTP Request

POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token

#### Parameters

- **name** (*in path*): string, required

  name of the TokenRequest

- **namespace** (*in path*): string, required

  namespace

- **body**: TokenRequest, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (TokenRequest): OK

201 (TokenRequest): Created

202 (TokenRequest): Accepted

401: Unauthorized

api metadata    apiVersion   authentication k8s io v1    import   k8s io api authentication v1    kind   TokenRequest  content type   api reference  description   TokenRequest requests a token for a given service account   title   TokenRequest  weight  2 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authentication k8s io v1    import  k8s io api authentication v1        TokenRequest   TokenRequest   TokenRequest requests a token for a given service account    hr       apiVersion    authentication k8s io v1       kind    TokenRequest       metadata     a href    ObjectMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    TokenRequestSpec  a    required    Spec holds information about the request being evaluated      status     a href    TokenRequestStatus  a      Status is filled in by the server and indicates whether the token can be authenticated          TokenRequestSpec   TokenRequestSpec   TokenRequestSpec contains client provided parameters of a token request    hr       audiences      string   required     Atomic  will be replaced during a merge       Audiences are the intendend audiences of the token  A recipient of a token must identify themself with an identifier in the list of audiences of the token  and otherwise should reject the token  A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences       boundObjectRef    BoundObjectReference     BoundObjectRef is a reference to an object that the token will be bound to  The token will only be valid for as long as the bound object exists  NOTE  The API server s TokenReview endpoint will validate the BoundObjectRef  but other audiences may not  Keep ExpirationSeconds small if you want prompt revocation      a name  BoundObjectReference    a     BoundObjectReference is a reference to an object that a token is bound to          boundObjectRef apiVersion    string       API version of the referent         boundObjectRef kind    string       Kind of the referent  Valid kinds are  Pod  and  Secret          boundObjectRef name    string       Name of the referent         boundObjectRef uid    string       UID of the referent       expirationSeconds    int64     ExpirationSeconds is the requested duration of validity of the request  The token issuer may return a token with a different validity duration so a client needs to check the  expiration  field in a response          TokenRequestStatus   TokenRequestStatus   TokenRequestStatus is the result of a token request    hr       expirationTimestamp    Time   required    ExpirationTimestamp is the time of expiration of the returned token      a name  Time    a     Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers        token    string   required    Token is the opaque bearer token          Operations   Operations      hr             create  create token of a ServiceAccount       HTTP Request  POST  api v1 namespaces  namespace  serviceaccounts  name  token       Parameters       name     in path    string  required    name of the TokenRequest       namespace     in path    string  required     a href    namespace  a        body     a href    TokenRequest  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    TokenRequest  a    OK  201   a href    TokenRequest  a    Created  202   a href    TokenRequest  a    Accepted  401  Unauthorized


kubernetes reference import k8s io api certificates v1 kind CertificateSigningRequest contenttype apireference CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request and having it asynchronously approved and issued title CertificateSigningRequest weight 4 apimetadata apiVersion certificates k8s io v1 autogenerated true

api metadata    apiVersion   certificates k8s io v1    import   k8s io api certificates v1    kind   CertificateSigningRequest  content type   api reference  description   CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request  and having it asynchronously approved and issued   title   CertificateSigningRequest  weight  4 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  certificates k8s io v1    import  k8s io api certificates v1        CertificateSigningRequest   CertificateSigningRequest   CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request  and having it asynchronously approved and issued   Kubelets use this API to obtain   1  client certificates to authenticate to kube apiserver  with the  kubernetes io kube apiserver client kubelet  signerName    2  serving certificates for TLS endpoints kube apiserver can connect to securely  with the  kubernetes io kubelet serving  signerName    This API can be used to request client certificates to authenticate to kube apiserver  with the  kubernetes io kube apiserver client  signerName   or to obtain certificates from custom non Kubernetes signers    hr       apiVersion    certificates k8s io v1       kind    CertificateSigningRequest       metadata     a href    ObjectMeta  a         spec     a href    CertificateSigningRequestSpec  a    required    spec contains the certificate request  and is immutable after creation  Only the request  signerName  expirationSeconds  and usages fields can be set on creation  Other fields are derived by Kubernetes and cannot be modified by users       status     a href    CertificateSigningRequestStatus  a      status contains information about whether the request is approved or denied  and the certificate issued by the signer  or the failure condition indicating signer failure          CertificateSigningRequestSpec   CertificateSigningRequestSpec   CertificateSigningRequestSpec contains the certificate request    hr       request      byte   required     Atomic  will be replaced during a merge       request contains an x509 certificate signing request encoded in a  CERTIFICATE REQUEST  PEM block  When serialized as JSON or YAML  the data is additionally base64 encoded       signerName    string   required    signerName indicates the requested signer  and is a qualified name       List watch requests for CertificateSigningRequests can filter on this field using a  spec signerName NAME  fieldSelector       Well known Kubernetes signers are     1   kubernetes io kube apiserver client   issues client certificates that can be used to authenticate to kube apiserver      Requests for this signer are never auto approved by kube controller manager  can be issued by the  csrsigning  controller in kube controller manager     2   kubernetes io kube apiserver client kubelet   issues client certificates that kubelets use to authenticate to kube apiserver      Requests for this signer can be auto approved by the  csrapproving  controller in kube controller manager  and can be issued by the  csrsigning  controller in kube controller manager     3   kubernetes io kubelet serving  issues serving certificates that kubelets use to serve TLS endpoints  which kube apiserver can connect to securely      Requests for this signer are never auto approved by kube controller manager  and can be issued by the  csrsigning  controller in kube controller manager       More details are available at https   k8s io docs reference access authn authz certificate signing requests  kubernetes signers      Custom signerNames can also be specified  The signer defines     1  Trust distribution  how trust  CA bundles  are distributed     2  Permitted subjects  and behavior when a disallowed subject is requested     3  Required  permitted  or forbidden x509 extensions in the request  including whether subjectAltNames are allowed  which types  restrictions on allowed values  and behavior when a disallowed extension is requested     4  Required  permitted  or forbidden key usages   extended key usages     5  Expiration certificate lifetime  whether it is fixed by the signer  configurable by the admin     6  Whether or not requests for CA certificates are allowed       expirationSeconds    int32     expirationSeconds is the requested duration of validity of the issued certificate  The certificate signer may issue a certificate with a different validity duration so a client must check the delta between the notBefore and and notAfter fields in the issued certificate to determine the actual duration       The v1 22  in tree implementations of the well known Kubernetes signers will honor this field as long as the requested duration is not greater than the maximum duration they will honor per the   cluster signing duration CLI flag to the Kubernetes controller manager       Certificate signers may not honor this field for various reasons         1  Old signer that is unaware of the field  such as the in tree        implementations prior to v1 22      2  Signer whose configured maximum is shorter than the requested duration     3  Signer whose configured minimum is longer than the requested duration      The minimum valid value for expirationSeconds is 600  i e  10 minutes       extra    map string   string     extra contains extra attributes of the user that created the CertificateSigningRequest  Populated by the API server on creation and immutable       groups      string      Atomic  will be replaced during a merge       groups contains group membership of the user that created the CertificateSigningRequest  Populated by the API server on creation and immutable       uid    string     uid contains the uid of the user that created the CertificateSigningRequest  Populated by the API server on creation and immutable       usages      string      Atomic  will be replaced during a merge       usages specifies a set of key usages requested in the issued certificate       Requests for TLS client certificates typically request   digital signature    key encipherment    client auth        Requests for TLS serving certificates typically request   key encipherment    digital signature    server auth        Valid values are      signing    digital signature    content commitment       key encipherment    key agreement    data encipherment       cert sign    crl sign    encipher only    decipher only    any       server auth    client auth       code signing    email protection    s mime       ipsec end system    ipsec tunnel    ipsec user       timestamping    ocsp signing    microsoft sgc    netscape sgc       username    string     username contains the name of the user that created the CertificateSigningRequest  Populated by the API server on creation and immutable          CertificateSigningRequestStatus   CertificateSigningRequestStatus   CertificateSigningRequestStatus contains conditions used to indicate approved denied failed status of the request  and the issued certificate    hr       certificate      byte      Atomic  will be replaced during a merge       certificate is populated with an issued certificate by the signer after an Approved condition is present  This field is set via the  status subresource  Once populated  this field is immutable       If the certificate signing request is denied  a condition of type  Denied  is added and this field remains empty  If the signer cannot issue the certificate  a condition of type  Failed  is added and this field remains empty       Validation requirements     1  certificate must contain one or more PEM blocks     2  All PEM blocks must have the  CERTIFICATE  label  contain no headers  and the encoded data     must be a BER encoded ASN 1 Certificate structure as described in section 4 of RFC5280     3  Non PEM content may appear before or after the  CERTIFICATE  PEM blocks and is unvalidated      to allow for explanatory text as described in section 5 2 of RFC7468       If more than one PEM block is present  and the definition of the requested spec signerName does not indicate otherwise  the first block is the issued certificate  and subsequent blocks should be treated as intermediate certificates and presented in TLS handshakes       The certificate is encoded in PEM format       When serialized as JSON or YAML  the data is additionally base64 encoded  so it consists of           base64             BEGIN CERTIFICATE                           END CERTIFICATE                   conditions      CertificateSigningRequestCondition      Map  unique values on key type will be kept during a merge       conditions applied to the request  Known conditions are  Approved    Denied   and  Failed       a name  CertificateSigningRequestCondition    a     CertificateSigningRequestCondition describes a condition of a CertificateSigningRequest object         conditions status    string   required      status of the condition  one of True  False  Unknown  Approved  Denied  and Failed conditions may not be  False  or  Unknown          conditions type    string   required      type of the condition  Known conditions are  Approved    Denied   and  Failed            An  Approved  condition is added via the  approval subresource  indicating the request was approved and should be issued by the signer           A  Denied  condition is added via the  approval subresource  indicating the request was denied and should not be issued by the signer           A  Failed  condition is added via the  status subresource  indicating the signer failed to issue the certificate           Approved and Denied conditions are mutually exclusive  Approved  Denied  and Failed conditions cannot be removed once added           Only one condition of a given type is allowed         conditions lastTransitionTime    Time       lastTransitionTime is the time the condition last transitioned from one status to another  If unset  when a new condition type is added or an existing condition s status is changed  the server defaults this to the current time        a name  Time    a       Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers          conditions lastUpdateTime    Time       lastUpdateTime is the time of the last update to this condition       a name  Time    a       Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers          conditions message    string       message contains a human readable message with details about the request state        conditions reason    string       reason indicates a brief reason for the request state         CertificateSigningRequestList   CertificateSigningRequestList   CertificateSigningRequestList is a collection of CertificateSigningRequest objects   hr       apiVersion    certificates k8s io v1       kind    CertificateSigningRequestList       metadata     a href    ListMeta  a         items       a href    CertificateSigningRequest  a    required    items is a collection of CertificateSigningRequest objects         Operations   Operations      hr             get  read the specified CertificateSigningRequest       HTTP Request  GET  apis certificates k8s io v1 certificatesigningrequests  name        Parameters       name     in path    string  required    name of the CertificateSigningRequest       pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  401  Unauthorized        get  read approval of the specified CertificateSigningRequest       HTTP Request  GET  apis certificates k8s io v1 certificatesigningrequests  name  approval       Parameters       name     in path    string  required    name of the CertificateSigningRequest       pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  401  Unauthorized        get  read status of the specified CertificateSigningRequest       HTTP Request  GET  apis certificates k8s io v1 certificatesigningrequests  name  status       Parameters       name     in path    string  required    name of the CertificateSigningRequest       pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  401  Unauthorized        list  list or watch objects of kind CertificateSigningRequest       HTTP Request  GET  apis certificates k8s io v1 certificatesigningrequests       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    CertificateSigningRequestList  a    OK  401  Unauthorized        create  create a CertificateSigningRequest       HTTP Request  POST  apis certificates k8s io v1 certificatesigningrequests       Parameters       body     a href    CertificateSigningRequest  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  202   a href    CertificateSigningRequest  a    Accepted  401  Unauthorized        update  replace the specified CertificateSigningRequest       HTTP Request  PUT  apis certificates k8s io v1 certificatesigningrequests  name        Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    CertificateSigningRequest  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        update  replace approval of the specified CertificateSigningRequest       HTTP Request  PUT  apis certificates k8s io v1 certificatesigningrequests  name  approval       Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    CertificateSigningRequest  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        update  replace status of the specified CertificateSigningRequest       HTTP Request  PUT  apis certificates k8s io v1 certificatesigningrequests  name  status       Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    CertificateSigningRequest  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        patch  partially update the specified CertificateSigningRequest       HTTP Request  PATCH  apis certificates k8s io v1 certificatesigningrequests  name        Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        patch  partially update approval of the specified CertificateSigningRequest       HTTP Request  PATCH  apis certificates k8s io v1 certificatesigningrequests  name  approval       Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        patch  partially update status of the specified CertificateSigningRequest       HTTP Request  PATCH  apis certificates k8s io v1 certificatesigningrequests  name  status       Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    CertificateSigningRequest  a    OK  201   a href    CertificateSigningRequest  a    Created  401  Unauthorized        delete  delete a CertificateSigningRequest       HTTP Request  DELETE  apis certificates k8s io v1 certificatesigningrequests  name        Parameters       name     in path    string  required    name of the CertificateSigningRequest       body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of CertificateSigningRequest       HTTP Request  DELETE  apis certificates k8s io v1 certificatesigningrequests       Parameters       body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference kind SelfSubjectReview weight 6 contenttype apireference import k8s io api authentication v1 SelfSubjectReview contains the user information that the kube apiserver has about the user making this request apimetadata title SelfSubjectReview apiVersion authentication k8s io v1 autogenerated true

Answer:
---
api_metadata:
  apiVersion: "authentication.k8s.io/v1"
  import: "k8s.io/api/authentication/v1"
  kind: "SelfSubjectReview"
content_type: "api_reference"
description: "SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request."
title: "SelfSubjectReview"
weight: 6
auto_generated: true
---

`apiVersion: authentication.k8s.io/v1`

`import "k8s.io/api/authentication/v1"`

## SelfSubjectReview {#SelfSubjectReview}

SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.

- **apiVersion**: authentication.k8s.io/v1

- **kind**: SelfSubjectReview

- **metadata** (ObjectMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **status** (SelfSubjectReviewStatus)

  Status is filled in by the server with the user attributes.

## SelfSubjectReviewStatus {#SelfSubjectReviewStatus}

SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.

- **userInfo** (UserInfo)

  User attributes of the user making this request.

  *UserInfo holds the information about the user needed to implement the user.Info interface.*

  - **userInfo.extra** (map[string][]string)

    Any additional information provided by the authenticator.

  - **userInfo.groups** ([]string)

    *Atomic: will be replaced during a merge*

    The names of groups this user is a part of.

  - **userInfo.uid** (string)

    A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.

  - **userInfo.username** (string)

    The name that uniquely identifies this user among all active users.

## Operations {#Operations}

### `create` create a SelfSubjectReview

#### HTTP Request

POST /apis/authentication.k8s.io/v1/selfsubjectreviews

#### Parameters

- **body**: SelfSubjectReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (SelfSubjectReview): OK

201 (SelfSubjectReview): Created

202 (SelfSubjectReview): Accepted

401: Unauthorized

api metadata    apiVersion   authentication k8s io v1    import   k8s io api authentication v1    kind   SelfSubjectReview  content type   api reference  description   SelfSubjectReview contains the user information that the kube apiserver has about the user making this request   title   SelfSubjectReview  weight  6 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authentication k8s io v1    import  k8s io api authentication v1        SelfSubjectReview   SelfSubjectReview   SelfSubjectReview contains the user information that the kube apiserver has about the user making this request  When using impersonation  users will receive the user info of the user being impersonated   If impersonation or request header authentication is used  any extra keys will have their case ignored and returned as lowercase    hr       apiVersion    authentication k8s io v1       kind    SelfSubjectReview       metadata     a href    ObjectMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      status     a href    SelfSubjectReviewStatus  a      Status is filled in by the server with the user attributes          SelfSubjectReviewStatus   SelfSubjectReviewStatus   SelfSubjectReviewStatus is filled by the kube apiserver and sent back to a user    hr       userInfo    UserInfo     User attributes of the user making this request      a name  UserInfo    a     UserInfo holds the information about the user needed to implement the user Info interface          userInfo extra    map string   string       Any additional information provided by the authenticator         userInfo groups      string        Atomic  will be replaced during a merge           The names of groups this user is a part of         userInfo uid    string       A unique value that identifies this user across time  If this user is deleted and another user by the same name is added  they will have different UIDs         userInfo username    string       The name that uniquely identifies this user among all active users          Operations   Operations      hr             create  create a SelfSubjectReview       HTTP Request  POST  apis authentication k8s io v1 selfsubjectreviews       Parameters       body     a href    SelfSubjectReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    SelfSubjectReview  a    OK  201   a href    SelfSubjectReview  a    Created  202   a href    SelfSubjectReview  a    Accepted  401  Unauthorized


kubernetes reference kind TokenReview contenttype apireference title TokenReview import k8s io api authentication v1 weight 3 apimetadata apiVersion authentication k8s io v1 TokenReview attempts to authenticate a token to a known user autogenerated true

Answer:
---
api_metadata:
  apiVersion: "authentication.k8s.io/v1"
  import: "k8s.io/api/authentication/v1"
  kind: "TokenReview"
content_type: "api_reference"
description: "TokenReview attempts to authenticate a token to a known user."
title: "TokenReview"
weight: 3
auto_generated: true
---

`apiVersion: authentication.k8s.io/v1`

`import "k8s.io/api/authentication/v1"`

## TokenReview {#TokenReview}

TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.

- **apiVersion**: authentication.k8s.io/v1

- **kind**: TokenReview

- **metadata** (ObjectMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (TokenReviewSpec), required

  Spec holds information about the request being evaluated

- **status** (TokenReviewStatus)

  Status is filled in by the server and indicates whether the request can be authenticated.

## TokenReviewSpec {#TokenReviewSpec}

TokenReviewSpec is a description of the token authentication request.

- **audiences** ([]string)

  *Atomic: will be replaced during a merge*

  Audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.

- **token** (string)

  Token is the opaque bearer token.

## TokenReviewStatus {#TokenReviewStatus}

TokenReviewStatus is the result of the token authentication request.

- **audiences** ([]string)

  *Atomic: will be replaced during a merge*

  Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is "true", the token is valid against the audience of the Kubernetes API server.

- **authenticated** (boolean)

  Authenticated indicates that the token was associated with a known user.

- **error** (string)

  Error indicates that the token couldn't be checked

- **user** (UserInfo)

  User is the UserInfo associated with the provided token.

  *UserInfo holds the information about the user needed to implement the user.Info interface.*

  - **user.extra** (map[string][]string)

    Any additional information provided by the authenticator.

  - **user.groups** ([]string)

    *Atomic: will be replaced during a merge*

    The names of groups this user is a part of.

  - **user.uid** (string)

    A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.

  - **user.username** (string)

    The name that uniquely identifies this user among all active users.

## Operations {#Operations}

### `create` create a TokenReview

#### HTTP Request

POST /apis/authentication.k8s.io/v1/tokenreviews

#### Parameters

- **body**: TokenReview, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (TokenReview): OK

201 (TokenReview): Created

202 (TokenReview): Accepted

401: Unauthorized

api metadata    apiVersion   authentication k8s io v1    import   k8s io api authentication v1    kind   TokenReview  content type   api reference  description   TokenReview attempts to authenticate a token to a known user   title   TokenReview  weight  3 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  authentication k8s io v1    import  k8s io api authentication v1        TokenReview   TokenReview   TokenReview attempts to authenticate a token to a known user  Note  TokenReview requests may be cached by the webhook token authenticator plugin in the kube apiserver    hr       apiVersion    authentication k8s io v1       kind    TokenReview       metadata     a href    ObjectMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    TokenReviewSpec  a    required    Spec holds information about the request being evaluated      status     a href    TokenReviewStatus  a      Status is filled in by the server and indicates whether the request can be authenticated          TokenReviewSpec   TokenReviewSpec   TokenReviewSpec is a description of the token authentication request    hr       audiences      string      Atomic  will be replaced during a merge       Audiences is a list of the identifiers that the resource server presented with the token identifies as  Audience aware token authenticators will verify that the token was intended for at least one of the audiences in this list  If no audiences are provided  the audience will default to the audience of the Kubernetes apiserver       token    string     Token is the opaque bearer token          TokenReviewStatus   TokenReviewStatus   TokenReviewStatus is the result of the token authentication request    hr       audiences      string      Atomic  will be replaced during a merge       Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token  An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token s audiences  A client of the TokenReview API that sets the spec audiences field should validate that a compatible audience identifier is returned in the status audiences field to ensure that the TokenReview server is audience aware  If a TokenReview returns an empty status audience field where status authenticated is  true   the token is valid against the audience of the Kubernetes API server       authenticated    boolean     Authenticated indicates that the token was associated with a known user       error    string     Error indicates that the token couldn t be checked      user    UserInfo     User is the UserInfo associated with the provided token      a name  UserInfo    a     UserInfo holds the information about the user needed to implement the user Info interface          user extra    map string   string       Any additional information provided by the authenticator         user groups      string        Atomic  will be replaced during a merge           The names of groups this user is a part of         user uid    string       A unique value that identifies this user across time  If this user is deleted and another user by the same name is added  they will have different UIDs         user username    string       The name that uniquely identifies this user among all active users          Operations   Operations      hr             create  create a TokenReview       HTTP Request  POST  apis authentication k8s io v1 tokenreviews       Parameters       body     a href    TokenReview  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    TokenReview  a    OK  201   a href    TokenReview  a    Created  202   a href    TokenReview  a    Accepted  401  Unauthorized