TeleportProvisionToken

resources.teleport.dev / v2

apiVersion: resources.teleport.dev/v2 kind: TeleportProvisionToken metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

ProvisionToken resource definition v2 from Teleport

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.

aws_account string

AWSAccount is the AWS account ID.

aws_arn string

AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".

aws_organization_id string

AWSOrganizationID is used for the IAM join method, the AWS identity of joining nodes must belong to this organization.

aws_organizational_units object

AWSOrganizationalUnits contains rules for matching AWS accounts based on their Organizational Units. Requires AWS Organization ID to be specified. The account's root ID is considered an Organizational Unit when validating the rule.

exclude []string

Exclude is a list of AWS Organizational Unit IDs and children OUs to exclude. Accounts that belong to these OUs, and their children, will be excluded, even if they were included. Only exact matches are supported. Optional. If empty, no OUs are excluded.

include []string

Include is a list of AWS Organizational Unit IDs and children OUs to include. Accounts that belong to these OUs, and their children, will be included. Only exact matches or wildcard (*) are supported. Required.

aws_regions []string

AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.

aws_role string

AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.

aws_iid_ttl string

AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.

format: duration

azure object

Azure allows the configuration of options specific to the "azure" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

resource_groups []string

ResourceGroups is a list of Azure resource groups the node is allowed to join from.

subscription string

Subscription is the Azure subscription.

tenant string

Tenant is the Azure Tenant ID.

azure_devops object

AzureDevops allows the configuration of options specific to the "azure_devops" join method.

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified.

definition_id string

The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.

pipeline_name string

The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.

project_id string

The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.

project_name string

The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.

repository_ref string

The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.

repository_uri string

The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.

repository_version string

The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.

sub string

Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.

organization_id string

OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.

bitbucket object

Bitbucket allows the configuration of options specific to the "bitbucket" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

branch_name string

BranchName is the name of the branch on which this pipeline executed.

deployment_environment_uuid string

DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.

repository_uuid string

RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.

workspace_uuid string

WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.

audience string

Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.

identity_provider_url string

IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.

bot_name string

BotName is the name of the bot this token grants access to, if any

bound_keypair object

BoundKeypair allows the configuration of options specific to the "bound_keypair" join method.

onboarding object

Onboarding contains parameters related to initial onboarding and keypair registration.

initial_public_key string

InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.

must_register_before string

MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.

format: date-time

registration_secret string

RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.

recovery object

Recovery contains parameters related to recovery after identity expiration.

limit integer

Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.

format: int32

mode string

Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.

rotate_after string

RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.

format: date-time

circleci object

CircleCI allows the configuration of options specific to the "circleci" join method.

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.

context_id string

project_id string

organization_id string

env0 object

Env0 allows the configuration of options specific to the "env0" join method.

allow []object

Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token.

deployer_email string

DeployerEmail is the email of the person that triggered the deployment, corresponding to `deployerEmail` in an Env0 OIDC token.

deployment_type string

DeploymentType is the env0 deployment type, such as "deploy", "destroy", etc. Corresponds to `deploymentType` in an Env0 OIDC token.

env0_tag string

Env0Tag is a custom tag value corresponding to `env0Tag` when `ENV0_OIDC_TAG` is set.

environment_id string

EnvironmentID is the unique identifier of the Env0 environment, corresponding to `environmentId` in an Env0 OIDC token.

environment_name string

EnvironmentName is the name of the Env0 environment, corresponding to `environmentName` in an Env0 OIDC token.

organization_id string

OrganizationID is the unique organization identifier, corresponding to `organizationId` in an Env0 OIDC token.

project_id string

ProjectID is a unique project identifier, corresponding to `projectId` in an Env0 OIDC token.

project_name string

ProjectName is the name of the project under which the job was run corresponding to `projectName` in an Env0 OIDC token.

template_id string

TemplateID is the unique identifier of the Env0 template, corresponding to `templateId` in an Env0 OIDC token.

template_name string

TemplateName is the name of the Env0 template, corresponding to `templateName` in an Env0 OIDC token.

workspace_name string

WorkspaceName is the name of the Env0 workspace, corresponding to `workspaceName` in an Env0 OIDC token.

gcp object

GCP allows the configuration of options specific to the "gcp" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

locations []string

Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").

project_ids []string

ProjectIDs is a list of project IDs (e.g. `<example-id-123456>`).

service_accounts []string

ServiceAccounts is a list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).

generic_oidc object

GenericOIDC allows the configuration of generic OIDC join tokens.

allow_any []object

AllowAny evaluates complex rules using "OR" semantics. If any rules are specified, at least one rule must evaluate to `true` for the join attempt to be allowed. These rules are evaluated after `must_match_fields`, if any field matchers are specified in that block. Note that at least one rule, either in `must_match_fields` or `allow_any`, must be specified for any join attempts to succeed.

conditions []object

Conditions are simple eq/not_eq/in/not_in conditions that check individual fields. All conditions must be satisfied for a join attempt to be allowed. Mutually exclusive with `expression`.

attribute string

The name of the field this condition should check, separated by "." for nested fields.

eq object

An "equals" operator. Only one operator may be set within a condition.

value string

The value to compare the attribute against.

in object

An "in" operator. Only one operator may be set within a condition.

values []string

The list of values to compare the attribute against.

not_eq object

A "not equals" operator. Only one operator may be set within a condition.

value string

The value to compare the attribute against.

not_in object

A "not in" operator. Only one operator may be set within a condition.

values []string

The list of values to compare the attribute against.

expression string

Expression is a predicate expression that must evaluate to `true` for the join attempt to be allowed. Expressions are provided the `claims` object, containing all claims extracted from the incoming JWT. It is mutually exclusive with `conditions`.

audience string

Audience is the expected audience value (required). This must match or be included in the list of `aud` values in the JWT provided by the client when joining. For providers that do not allow you to configure this value yourself (this is technically an OIDC spec violation, but is common), use the value they provide. Otherwise, we recommend using a value that uniquely identifies the Teleport cluster and join token. For example, you can use this scheme: $clusterName/$tokenName For a cluster named `example.teleport.sh` and a token named `example`, this would result in an audience of `example.teleport.sh/example`. If you prefer, you can also use a UUID instead of the token name. Note that you will need to configure the matching value with the issuer, usually at request time.

insecure_allow_http_issuer boolean

InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.

issuer string

Issuer contains the expected `iss` value as written in the JWT you wish to trust. Unless `static_jwks` is configured, this issuer must be accessible over HTTPS to the Teleport cluster and must serve valid OIDC metadata, including discovery configuration and JWKS keys.

must_match_fields object

MustMatchFields perform simple comparison matches using "AND" semantics. Rules are specified by mirroring the structure of the JWT, using values that are expected to be equal to those on the incoming token. These field matching rules can only be used to compare simple values: strings, numbers, booleans, and nested fields. Complex values, including lists, will need to use `allow_any` expression rules instead. If any field match rules are specified, all must be equal to corresponding JWT fields for the join attempt to succeed. If complex rules are specified in `allow_any`, those are evaluated after `must_match_fields`. If `must_match_fields` is not specified or is empty, only rules in `allow_any` are evaluated. These rules can be used as "global" rules that apply to all join attempts. For example, you can use these to ensure all attempts originate from your organization, then use `allow_any` rules to allow individual repositories, pipelines, or workspaces. Note that at least one rule, either in `must_match_fields` or `allow_any`, must be specified for any join attempts to succeed.

static_jwks string

StaticJWKS is an optional static JWKS value that can be used to specify JWKS keys when either OIDC discovery is either not supported by the provider or the discovery configuration is not accessible to Teleport. When set, configuration and JWKS keys will not be fetched from the URL contained in `issuer` and JWTs will be validated using the key set specified here.

tls_ca string

TLSCA is a TLS CA certificate that should be used to verify requests for OIDC metadata from the issuer instead of Teleport's CA store, useful if the issuer is not public or otherwise uses a self-signed certificate. Note that this value only applies to requests using this token, and will be used instead of and not in addition to the system CA store, and will need to be updated manually if the remote CA is updated.

github object

GitHub allows the configuration of options specific to the "github" join method.

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.

actor string

The personal account that initiated the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enterprise string

The name of the enterprise in which the repository is stored.

enterprise_id string

The ID of the enterprise in which the repository is stored.

environment string

The name of the environment used by the job. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref string

The git ref that triggered the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref_type string

The type of ref, for example: "branch".

repository string

The repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

repository_owner string

The name of the organization in which the repository is stored. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

sub string

Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

workflow string

The name of the workflow. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enterprise_server_host string

EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host. This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.

enterprise_slug string

EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE. This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified. See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.

static_jwks string

StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.

gitlab object

GitLab allows the configuration of options specific to the "gitlab" join method.

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.

ci_config_ref_uri string

CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.

ci_config_sha string

CIConfigSHA is the git commit SHA for the ci_config_ref_uri.

deployment_tier string

DeploymentTier is the deployment tier of the environment the job specifies

environment string

Environment limits access by the environment the job deploys to (if one is associated)

environment_protected boolean

EnvironmentProtected is true if the Git ref is protected, false otherwise.

namespace_path string

NamespacePath is used to limit access to jobs in a group or user's projects. Example: `mygroup` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

pipeline_source string

PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`

project_path string

ProjectPath is used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

project_visibility string

ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.

ref string

Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref_protected boolean

RefProtected is true if the Git ref is protected, false otherwise.

ref_type string

RefType allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`

sub string

Sub roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

user_email string

UserEmail is the email of the user executing the job

user_id string

UserID is the ID of the user executing the job

user_login string

UserLogin is the username of the user executing the job

domain string

Domain is the domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.

static_jwks string

StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.

integration string

Integration name which provides credentials for validating join attempts. Currently only in use for validating the AWS Organization ID in the IAM Join method.

join_method string

JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm

kubernetes object

Kubernetes allows the configuration of options specific to the "kubernetes" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

service_account string

ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".

service_account_name string

ServiceAccountName is the name of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

service_account_namespace string

ServiceAccountNamespace is the namespace of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

oidc object

OIDCConfig configures the `oidc` type.

insecure_allow_http_issuer boolean

InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.

issuer string

Issuer is the URI of the OIDC issuer. It must have an accessible and OIDC-compliant `/.well-known/oidc-configuration` endpoint. This should be a valid URL and must exactly match the `issuer` field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...

static_jwks object

StaticJWKS is the configuration specific to the `static_jwks` type.

jwks string

JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.

type string

Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - `in_cluster` - `static_jwks` - `oidc` If unset, this defaults to `in_cluster`.

oracle object

Oracle allows the configuration of options specific to the "oracle" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

instances []string

Instances is a list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.

parent_compartments []string

ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.

regions []string

Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.

tenancy string

Tenancy is the OCID of the instance's tenancy. Required.

roles []string

Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token

spacelift object

Spacelift allows the configuration of options specific to the "spacelift" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

caller_id string

CallerID is the ID of the caller, ie. the stack or module that generated the run. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.

caller_type string

CallerType is the type of the caller, ie. the entity that owns the run - either `stack` or `module`.

scope string

Scope is the scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes

space_id string

SpaceID is the ID of the space in which the run that owns the token was executed. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enable_glob_matching boolean

EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.

hostname string

Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g `example.app.spacelift.io`

suggested_agent_matcher_labels object

SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to `db_service.resources.labels`. Currently, only node-join scripts create a configuration according to the suggestion.

suggested_labels object

SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.

terraform_cloud object

TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method.

allow []object

Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

organization_id string

OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.

organization_name string

OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.

project_id string

ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.

project_name string

ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.

run_phase string

RunPhase is the phase of the run the token was issued for, e.g. `plan` or `apply`

workspace_id string

WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.

workspace_name string

WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.

audience string

Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the variable is set to match the cluster name, it does not need to be set here.

hostname string

Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be `app.terraform.io`. Otherwise, it must both match the `iss` (issuer) field included in JWTs, and provide standard JWKS endpoints.

tpm object

TPM allows the configuration of options specific to the "tpm" join method.

allow []object

Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining.

description string

Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"

ek_certificate_serial string

EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4

ek_public_hash string

EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6

ekcert_allowed_cas []string

EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.

status object

Status defines the observed state of the Teleport resource

conditions []object

Conditions represent the latest available observations of an object's state

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

teleportResourceID integer

format: int64

No matches. Try .spec.allow for an exact path