{ "description": "AppV3 is the Schema for the appsv3 API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "kind": { "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "spec": { "additionalProperties": false, "description": "App resource definition v3 from Teleport", "properties": { "UserGroups": { "description": "UserGroups are a list of user group IDs that this app is associated with.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "aws": { "additionalProperties": false, "description": "AWS contains additional options for AWS applications.", "nullable": true, "properties": { "external_id": { "description": "ExternalID is the AWS External ID used when assuming roles in this app.", "type": [ "string", "null" ] }, "roles_anywhere_profile": { "additionalProperties": false, "description": "RolesAnywhereProfile contains the IAM Roles Anywhere fields associated with this Application. These fields are set when performing the synchronization of AWS IAM Roles Anywhere Profiles into Teleport Apps.", "nullable": true, "properties": { "accept_role_session_name": { "description": "Whether this Roles Anywhere Profile accepts a custom role session name. When not supported, the AWS Session Name will be the X.509 certificate's serial number. When supported, the AWS Session Name will be the identity's username. This value comes from: https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ProfileDetail.html / acceptRoleSessionName", "type": [ "boolean", "null" ] }, "profile_arn": { "description": "ProfileARN is the AWS IAM Roles Anywhere Profile ARN that originated this Teleport App.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "cloud": { "description": "Cloud identifies the cloud instance the app represents.", "type": [ "string", "null" ] }, "cors": { "additionalProperties": false, "description": "CORSPolicy defines the Cross-Origin Resource Sharing settings for the app.", "nullable": true, "properties": { "allow_credentials": { "description": "allow_credentials indicates whether credentials are allowed.", "type": [ "boolean", "null" ] }, "allowed_headers": { "description": "allowed_headers specifies which headers can be used when accessing the app.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "allowed_methods": { "description": "allowed_methods specifies which methods are allowed when accessing the app.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "allowed_origins": { "description": "allowed_origins specifies which origins are allowed to access the app.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "exposed_headers": { "description": "exposed_headers indicates which headers are made available to scripts via the browser.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "max_age": { "description": "max_age indicates how long (in seconds) the results of a preflight request can be cached.", "format": "int32", "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] }, "dynamic_labels": { "additionalProperties": { "additionalProperties": false, "nullable": true, "properties": { "command": { "description": "Command is a command to run", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "period": { "description": "Period is a time between command runs", "format": "duration", "type": [ "string", "null" ] }, "result": { "description": "Result captures standard output", "type": [ "string", "null" ] } }, "type": "object" }, "description": "DynamicLabels are the app's command labels.", "type": [ "object", "null" ] }, "identity_center": { "additionalProperties": false, "description": "IdentityCenter encapsulates information specific to AWS IAM Identity Center. Only valid for Identity Center account apps.", "nullable": true, "properties": { "account_id": { "description": "Account ID is the AWS-assigned ID of the account", "type": [ "string", "null" ] }, "permission_sets": { "description": "PermissionSets lists the available permission sets on the given account", "items": { "additionalProperties": false, "properties": { "arn": { "description": "ARN is the fully-formed ARN of the Permission Set.", "type": [ "string", "null" ] }, "assignment_name": { "description": "AssignmentID is the ID of the Teleport Account Assignment resource that represents this permission being assigned on the enclosing Account.", "type": [ "string", "null" ] }, "name": { "description": "Name is the human-readable name of the Permission Set.", "type": [ "string", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "inference": { "additionalProperties": false, "description": "LLM contains LLM inference endpoint related configurations.", "nullable": true, "properties": { "fallback_model": { "description": "Defines a model that will be used if the model requested is not on the list. The fallback model must be in the \"models\" list.", "type": [ "string", "null" ] }, "format": { "description": "Defines the LLM inference API format.", "type": [ "string", "null" ] }, "models": { "description": "Defines the list of supported models, and optionally their name on the inference provider.", "items": { "additionalProperties": false, "properties": { "name": { "type": [ "string", "null" ] }, "provider_name": { "type": [ "string", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "provider": { "description": "Defines which inference provider will be used to serve the requests.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "insecure_skip_verify": { "description": "InsecureSkipVerify disables app's TLS certificate verification.", "type": [ "boolean", "null" ] }, "integration": { "description": "Integration is the integration name that must be used to access this Application. Only applicable to AWS App Access. If present, the Application must use the Integration's credentials instead of ambient credentials to access Cloud APIs.", "type": [ "string", "null" ] }, "mcp": { "additionalProperties": false, "description": "MCP contains MCP server related configurations.", "nullable": true, "properties": { "args": { "description": "Args to execute with the command.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "command": { "description": "Command to launch stdio-based MCP servers.", "type": [ "string", "null" ] }, "run_as_host_user": { "description": "RunAsHostUser is the host user account under which the command will be executed. Required for stdio-based MCP servers.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "public_addr": { "description": "PublicAddr is the public address the application is accessible at.", "type": [ "string", "null" ] }, "required_app_names": { "description": "RequiredAppNames is a list of app names that are required for this app to function. Any app listed here will be part of the authentication redirect flow and authenticate alongside this app.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "rewrite": { "additionalProperties": false, "description": "Rewrite is a list of rewriting rules to apply to requests and responses.", "nullable": true, "properties": { "headers": { "description": "Headers is a list of headers to inject when passing the request over to the application.", "items": { "additionalProperties": false, "properties": { "name": { "description": "Name is the http header name.", "type": [ "string", "null" ] }, "value": { "description": "Value is the http header value.", "type": [ "string", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "jwt_claims": { "description": "JWTClaims configures whether roles/traits are included in the JWT token.", "type": [ "string", "null" ] }, "redirect": { "description": "Redirect defines a list of hosts which will be rewritten to the public address of the application if they occur in the \"Location\" header.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "tcp_ports": { "description": "TCPPorts is a list of ports and port ranges that an app agent can forward connections to. Only applicable to TCP App Access. If this field is not empty, URI is expected to contain no port number and start with the tcp protocol.", "items": { "additionalProperties": false, "properties": { "end_port": { "description": "EndPort describes the end of the range, inclusive. If set, it must be between 2 and 65535 and be greater than Port when describing a port range. When omitted or set to zero, it signifies that the port range defines a single port.", "format": "int32", "type": [ "integer", "null" ] }, "port": { "description": "Port describes the start of the range. It must be between 1 and 65535.", "format": "int32", "type": [ "integer", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "tls": { "additionalProperties": false, "description": "TLS contains the app TLS configuration.", "nullable": true, "properties": { "allowed_cas": { "description": "AllowedCas is the list of user provided CAs used for verifying upstream certificates. Accepted values are PEM-encoded CA certificates and Teleport CA aliases. Supported aliases: \"workload_identity\" (workload Identity CA. Allows accepting certificates issued by `tbot`).", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "client_cert_mode": { "description": "ClientCertMode specifies which client certificate mode to use for the upstream connection. Supported values: \"managed\" (app service will issue client certificates to use in the app upstream connection, establishing mTLS connections), \"disabled\" (app upstream connection won't use client certificates).", "type": [ "string", "null" ] }, "mode": { "description": "Mode defines the TLS verification. Supported values: \"verify-full\" (performs certificate validation, and asserts server name and SPIFFE ID), \"verify-server-name\" (performs certificate validation, and asserts server name), \"verify-spiffe-id\": (performs certificate validation, and asserts SPIFFE ID. Requires `server_spiffe_id` option), \"insecure\": (accepts any certificate provided by app)", "type": [ "string", "null" ] }, "server_name": { "description": "ServerName specifies a custom hostname used for TLS verification against the upstream certificate.", "type": [ "string", "null" ] }, "server_spiffe_id": { "description": "ServerSpiffeId specifies a SPIFFE ID that must be present on the server certificate.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "uri": { "description": "URI is the web app endpoint.", "type": [ "string", "null" ] }, "use_any_proxy_public_addr": { "description": "UseAnyProxyPublicAddr will rebuild this app's fqdn based on the proxy public addr that the request originated from. This should be true if your proxy has multiple proxy public addrs and you want the app to be accessible from any of them. If `public_addr` is explicitly set in the app spec, setting this value to true will overwrite that public address in the web UI.", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "status": { "additionalProperties": false, "description": "Status defines the observed state of the Teleport resource", "properties": { "conditions": { "description": "Conditions represent the latest available observations of an object's state", "items": { "additionalProperties": false, "description": "Condition contains details for one aspect of the current state of this API Resource.", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", "maxLength": 32768, "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "minimum": 0, "type": [ "integer", "null" ] }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", "maxLength": 1024, "minLength": 1, "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "enum": [ "True", "False", "Unknown" ], "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", "maxLength": 316, "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "teleportResourceID": { "format": "int64", "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object" }