TeleportScopedTokenV1

resources.teleport.dev / v1

apiVersion: resources.teleport.dev/v1 kind: TeleportScopedTokenV1 metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

scope string

Scope is the scope of the token resource.

spec object

ScopedToken resource definition v1 from Teleport

assigned_scope string

The scope to which this token is assigned. Must be equivalent or descendent to the scope of the token itself.

aws object

The AWS-specific configuration used with the "ec2" and "iam" join methods.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

aws_account string

The AWS account ID.

aws_arn string

The ARN of the joining identity for use with the IAM join method. Supports wildcards "*" and "?".

aws_organization_id string

The organization ID that the joining AWS identity must belong to when using the IAM join method.

aws_regions []string

List of AWS regions a node is allowed to join from when using the EC2 join method.

aws_role string

The ARN of the role the Auth Service will assume in order to call the EC2 API when using the EC2 join method.

iid_ttl string

The TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token. This should be a duration string such as "8h" or "6mo".

integration string

Integration name which provides credentials for validating join attempts. Currently only in use for validating the AWS Organization ID in the IAM Join method.

azure object

The Azure-specific configuration used with the "azure" join method.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

resource_groups []string

A list of Azure resource groups the node is allowed to join from.

subscription string

The Azure subscription.

tenant string

Tenant is the Azure Tenant ID.

azure_devops object

The Azure Devops-specific configuration used with the "azure_devops" join method.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

definition_id string

The ID of the AZDO pipeline definition. Example: `1` Mapped from the `def_id` claim.

pipeline_name string

The name of the AZDO pipeline. Example: `my-pipeline`. Mapped out of the `sub` claim.

project_id string

The ID of the AZDO pipeline. Example: `271ef6f7-0000-0000-0000-4b54d9129990` Mapped from the `prj_id` claim.

project_name string

The name of the AZDO project. Example: `my-project`. Mapped out of the `sub` claim.

repository_ref string

The reference of the repository the pipeline is using. Example: `refs/heads/main`. Mapped from the `rpo_ref` claim.

repository_uri string

The URI of the repository the pipeline is using. Example: `https://github.com/gravitational/teleport.git`. Mapped from the `rpo_uri` claim.

repository_version string

The individual commit of the repository the pipeline is using. Example: `e6b9eb29a288b27a3a82cc19c48b9d94b80aff36`. Mapped from the `rpo_ver` claim.

sub string

The subject string that roughly uniquely identifies the workload. Example: `p://my-organization/my-project/my-pipeline` Mapped from the `sub` claim.

organization_id string

The UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.

bitbucket object

Configuration specific to the "bitbucket" join method.

allow []object

A list of rules. Workloads trying to join must match at least one allow rule for the join attempt to be allowed.

branch_name string

The name of the branch on which this pipeline executed.

deployment_environment_uuid string

The UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.

repository_uuid string

The UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. `{...}`. This value may be found in the "Pipelines -> OpenID Connect" section of the repository settings.

workspace_uuid string

The UUID of the workspace for which this token was issued. This value may be found in the "Pipelines -> OpenID Connect" section of the repository settings.

audience string

The Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the "Pipelines -> OpenID Connect" section of the repository settings.

identity_provider_url string

A Bitbucket-specified issuer URL for the incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the "Pipelines -> OpenID Connect" section of the repository settings.

bot string

The bot associated with this join token, if any, as a scope-qualified name of the form `<scope>::<bot-name>` (e.g. "/staging/west::mybot"). The scope component must be a descendant of or equivalent to the token's resource scope. Mutually exclusive with assigned_scope.

bound_keypair object

Configuration specific to the "bound_keypair" join method.

onboarding object

Parameters related to initial onboarding and keypair registration.

initial_public_key string

The initial public key is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format.

must_register_before string

An optional time before which registration via registration join secret must be performed. Attempts to register using a registration secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.

format: date-time

registration_secret string

A secret that joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.

recovery object

Parameters related to recovery after identity expiration, including the initial join.

limit integer

The maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If `mode` is set to `standard`, recovery attempts will only be allowed if `.status.bound_keypair.recovery_count` is less than this limit. This limit is not enforced if `mode` is set to `relaxed` or `insecure`. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.

format: int32

mode string

Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.

rotate_after string

An optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If `LastRotatedAt` is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.

format: date-time

circleci object

Configuration specific to the "circleci" join method

allow []object

Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one rule is required.

context_id string

A unique context identifier. At least one of context_id or project_id is required.

project_id string

A unique project identifier. At least one of project_id or context_id is required.

organization_id string

The unique identifier of the organization. Required.

env0 object

Configuration specific to the "env0" join method.

allow []object

A list of rules allowed by this token. Clients attempting to join must present a JWT matching at least one of these rules.

deployer_email string

The email of the person that triggered the deployment, corresponding to `deployerEmail` in an Env0 OIDC token.

deployment_type string

The env0 deployment type, such as "deploy", "destroy", etc. Corresponds to `deploymentType` in an Env0 OIDC token.

env0_tag string

A custom tag value corresponding to the JWT's `env0Tag` when `ENV0_OIDC_TAG` is set.

environment_id string

The unique identifier of the Env0 environment, corresponding to `environmentId` in an Env0 OIDC token.

environment_name string

The name of the Env0 environment, corresponding to `environmentName` in an Env0 OIDC token.

organization_id string

A unique organization identifier, corresponding to `organizationId` in an Env0 OIDC token.

project_id string

A unique project identifier, corresponding to `projectId` in an Env0 OIDC token.

project_name string

The name of the project under which the job was run corresponding to `projectName` in an Env0 OIDC token.

template_id string

The unique identifier of the Env0 template, corresponding to `templateId` in an Env0 OIDC token.

template_name string

The name of the Env0 template, corresponding to `templateName` in an Env0 OIDC token.

workspace_name string

The name of the Env0 workspace, corresponding to `workspaceName` in an Env0 OIDC token.

gcp object

The GCP-specific configuration used with the "gcp" join method.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

locations []string

A list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").

project_ids []string

A list of project IDs (e.g. `<example-id-123456>`).

service_accounts []string

A list of service account emails (e.g. `<project-number>-compute@developer.gserviceaccount.com`).

generic_oidc object

Configuration specific to the "generic_oidc" join method.

allow_any []object

Complex rules evaluated using "OR" semantics. If any rules are specified, at least one rule must evaluate to `true` for the join attempt/ to be allowed. These rules are evaluated after `must_match_fields`, if any field matchers are specified in that block. Note that at least one rule, either in `must_match_fields` or `allow_any`, must be specified for any join attempts to succeed.

conditions []object

Conditions are simple eq/not_eq/in/not_in conditions that check individual fields. All conditions must be satisfied for a join attempt to be allowed. Mutually exclusive with `expression`.

attribute string

The name of the field this condition should check, separated by "." for nested fields.

eq object

An "equals" operator. Only one operator may be set within a condition.

value string

The value to compare the attribute against.

in object

An "in" operator. Only one operator may be set within a condition.

values []string

The list of values to compare the attribute against.

not_eq object

A "not equals" operator. Only one operator may be set within a condition.

value string

The value to compare the attribute against.

not_in object

A "not in" operator. Only one operator may be set within a condition.

values []string

The list of values to compare the attribute against.

expression string

A predicate expression that must evaluate to `true` for the join attempt to be allowed. It is mutually exclusive with `conditions`. TODO: Include name of variable available to the expr in docs

audience string

The expected JWT audience value (required). This must match or be included in the list of `aud` values in the JWT provided by the client when joining. For providers that do not allow you to configure this value yourself (this is technically an OIDC spec violation, but is common), use the value they provide. Otherwise, we recommend using a value that uniquely identifies the Teleport cluster and join token. For example, you can use this scheme: $clusterName/$tokenName For a cluster named `example.teleport.sh` and a token named `example`, this would result in an audience of `example.teleport.sh/example`. If you prefer, you can also use a UUID instead of the token name. Note that you will need to configure the matching value with the issuer, usually at request time.

insecure_allow_http_issuer boolean

If set, disables the requirement that the issuer must use HTTPS.

issuer string

The expected `iss` value as written in the JWT you wish to trust. Unless `static_jwks` is configured, this issuer must be accessible over HTTPS to the Teleport cluster and must serve valid OIDC metadata, including discovery configuration and JWKS keys.

must_match_fields object

"Must match" fields perform simple comparison matches using "AND" semantics. Rules are specified by mirroring the structure of the JWT, using values that are expected to be equal to those on the incoming token. These field matching rules can only be used to compare simple values: strings, numbers, booleans, and nested fields. Complex values, including lists, will need to use `allow_any` expression rules instead. If any field match rules are specified, all must be equal to corresponding JWT fields for the join attempt to succeed. If complex rules are specified in `allow_any`, those are evaluated after `must_match_fields`. If `must_match_fields` is not specified or is empty, only rules in `allow_any` are evaluated. These rules can be used as "global" rules that apply to all join attempts. For example, you can use these to ensure all attempts originate from your organization, then use `allow_any` rules to allow individual repositories, pipelines, or workspaces. Note that at least one rule, either in `must_match_fields` or `allow_any`, must be specified for any join attempts to succeed.

static_jwks string

An optional static JWKS value that can be used to specify JWKS keys when either OIDC discovery is either not supported by the provider or the discovery configuration is not accessible to Teleport. When set, configuration and JWKS keys will not be fetched from the URL contained in `issuer` and JWTs will be validated using the key set specified here.

tls_ca string

A TLS CA certificate that should be used to verify requests for OIDC metadata from the issuer instead of Teleport's CA store, useful if the issuer is not public or otherwise uses a self-signed certificate. If unset, the standard web PKI root certificates will be used to verify the connection to the issuer when fetching OIDC metadata. Note that this value only applies to requests using this token, and will be used instead of and not in addition to the system CA store, and will need to be updated manually if the remote CA is updated.

github object

Configuration specific to the "github" join method.

allow []object

allow is a set of claim-matching fields evaluated against the GitHub Actions OIDC token.

actor string

actor is the personal account that initiated the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enterprise string

enterprise name in which the repository is stored.

enterprise_id string

enterprise_id in which the repository is stored.

environment string

environment name used by the job. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref string

ref (git) that triggered the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref_type string

ref_type for example: "branch".

repository string

repository from where the workflow is running. This includes the name of the owner e.g `gravitational/teleport` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

repository_owner string

repository_owner is the name of the organization in which the repository is stored. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

sub string

sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

workflow string

workflow name. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enterprise_server_host string

enterprise_server_host allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host. This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.

enterprise_slug string

enterprise_slug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the `include_enterprise_slug` option in GHE. This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if `enterprise_server_host` is specified. See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.

static_jwks string

static_jwks disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.

gitlab object

Configuration specific to the "gitlab" join method.

allow []object

A set of claim-matching fields evaluated against the GitLab CI token.

ci_config_ref_uri string

The ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.

ci_config_sha string

The git commit SHA for the ci_config_ref_uri.

deployment_tier string

The deployment tier of the environment the job specifies

environment string

Limits access by the environment the job deploys to (if one is associated)

environment_protected boolean

True if the Git ref is protected, false otherwise.

namespace_path string

Used to limit access to jobs in a group or user's projects. Example: `mygroup` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

pipeline_source string

Limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: `web`

project_path string

Used to limit access to jobs belonging to an individual project. Example: `mygroup/myproject` This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

project_visibility string

The visibility of the project where the pipeline is running. Can be internal, private, or public.

ref string

Allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

ref_protected boolean

True if the Git ref is protected, false otherwise.

ref_type string

Allows access to be limited to jobs triggered by a specific git ref type. Example: `branch` or `tag`

sub string

Roughly uniquely identifies the workload. Example: `project_path:mygroup/my-project:ref_type:branch:ref:main` project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

user_email string

The email of the user executing the job

user_id string

The ID of the user executing the job

user_login string

The username of the user executing the job

domain string

The domain of your GitLab instance. This will default to `gitlab.com` - but can be set to the domain of your self-hosted GitLab e.g `gitlab.example.com`.

static_jwks string

Disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.

immutable_labels object

Immutable labels that should be applied to any resulting resources provisioned using this token.

ssh object

Labels that should be applied to SSH nodes.

join_method string

The joining method required in order to use this token. Note that not all join methods support joining with scoped tokens.

kubernetes object

The Kubernetes-specific configuration used with the "kubernetes" join method.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

service_account string

The namespaced name of the Kubernetes service account. Its format is "namespace:service-account".

service_account_name string

The name of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

service_account_namespace string

The namespace of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

oidc object

The configuration specific to the `oidc` type.

insecure_allow_http_issuer boolean

If set, disables the requirement that the issuer must use HTTPS.

issuer string

The URI of the OIDC issuer. It must have an accessible and OIDC-compliant `/.well-known/openid-configuration` endpoint. This should be a valid URL and must exactly match the `issuer` field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...

static_jwks object

The configuration specific to the `static_jwks` type.

jwks string

The JSON Web Key Set formatted public keys that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.

type string

Controls which behavior should be used for validating the Kubernetes Service Account token. Supported values: - `in_cluster` - `static_jwks` - `oidc`

oracle object

The Oracle-specific configuration used with the "oracle" join method.

allow []object

A list of Rules for allowing use of this token. A node must match at least one allow rule in order to use this token.

instances []string

A list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.

parent_compartments []string

A list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.

regions []string

A list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.

tenancy string

The OCID of the instance's tenancy. Required.

roles []string

The list of roles associated with the token. They will be converted to metadata in the SSH and X509 certificates issued to the user of the token.

spacelift object

Configuration specific to the "spacelift" join method.

allow []object

A list of rules allowed by this token. Clients attempting to join must present a JWT matching at least one of these rules.

caller_id string

The ID of the caller, ie. the stack or module that generated the run. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.

caller_type string

The type of the caller, ie. the entity that owns the run, either `stack` or `module`.

scope string

The scope of the token - either `read` or `write`. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes

space_id string

The ID of the space in which the run that owns the token was executed. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.

enable_glob_matching boolean

Enables glob-style matching for the space_id and caller_id fields in the rules.

hostname string

The hostname of the Spacelift tenant that tokens will originate from, e.g. `example.app.spacelift.io`

terraform_cloud object

Configuration specific to the "terraform_cloud" join method.

allow []object

A list of rules allowed by this token. Clients attempting to join must present a JWT matching at least one of these rules.

organization_id string

The ID of the HCP Terraform organization. At least one of `organization_id` or `organization_name` must be provided.

organization_name string

The human-readable name of the HCP Terraform organization. At least one of `organization_id` or `organization_name` must be provided.

project_id string

The ID of the HCP Terraform project. At least one of `project_id`, `project_name`, `workspace_id`, or `workspace_name` is required.

project_name string

The human-readable name of the HCP Terraform project. At least one of `project_id`, `project_name`, `workspace_id`, or `workspace_name` is required.

run_phase string

The phase of the run the token was issued for, e.g. `plan` or `apply`

workspace_id string

The ID of the HCP Terraform workspace. At least one of `project_id`, `project_name`, `workspace_id`, or `workspace_name` is required.

workspace_name string

The human-readable name of the HCP Terraform workspace. At least one of `project_id`, `project_name`, `workspace_id`, or `workspace_name` is required.

audience string

The JWT audience (`aud`) to expect as configured in the `TFC_WORKLOAD_IDENTITY_AUDIENCE_($TAG)` variable set in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is set in Terraform Cloud, this value should be `foo`. If the value is your Teleport cluster name, it does not need to be configured here.

hostname string

The hostname of the Terraform Enterprise instance expected to issue JWTs accepted by this token. If unset, it defaults to the default Terraform Cloud issuer, `app.terraform.io`; otherwise, it must match the `iss` field in JWTs issued by the Terraform Enterprise provider.

tpm object

Configuration specific to the "tpm" join method.

allow []object

A list of Rules, the presented delegated identity must match one allow rule to permit joining.

description string

A human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"

ek_certificate_serial string

The serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4

ek_public_hash string

The SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6

ekcert_allowed_cas []string

A list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.

usage_mode string

The usage mode of the token. Can be "single_use" or "unlimited". Single use tokens can only be used to provision a single resource. Unlimited tokens can be be used to provision any number of resources until it expires.

status object

Status defines the observed state of the Teleport resource

conditions []object

Conditions represent the latest available observations of an object's state

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

teleportResourceID integer

format: int64

No matches. Try .spec.assigned_scope for an exact path