TeleportWorkloadIdentityV1
resources.teleport.dev / v1
apiVersion: resources.teleport.dev/v1
kind: TeleportWorkloadIdentityV1
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
WorkloadIdentity resource definition v1 from Teleport
rules object
The rules which are evaluated before the WorkloadIdentity can be issued.
allow []object
A list of rules used to determine if a WorkloadIdentity can be issued. If none are provided, it will be considered a pass. If any are provided, then at least one must pass for the rules to be considered passed.
conditions []object
The conditions that must be met for this rule to be considered passed. Mutually exclusive with expression.
attribute
string
The name of the attribute to evaluate the condition against.
eq object
The attribute casted to a string must be equal to the value.
value
string
The value to compare the attribute against.
in object
The attribute casted to a string must be in the list of values.
values
[]string
The list of values to compare the attribute against.
not_eq object
The attribute casted to a string must not be equal to the value.
value
string
The value to compare the attribute against.
not_in object
The attribute casted to a string must not be in the list of values.
values
[]string
The list of values to compare the attribute against.
expression
string
An expression written in Teleport's predicate language that must evaluate to true for this rule to be considered passed. Mutually exclusive with conditions.
spiffe object
Configuration pertaining to the issuance of SPIFFE-compatible workload identity credentials.
hint
string
A freeform text field which is provided to workloads along with a credential produced by this WorkloadIdentity. This can be used to provide additional context that can be used to select between multiple credentials.
id
string
The path of the SPIFFE ID that will be issued to the workload. This should be prefixed with a forward-slash ("/"). This field supports templating using attributes.
jwt object
Configuration specific to JWT-SVIDs.
extra_claims
object
Additional claims that will be added to the JWT.
maximum_ttl
string
Control the maximum TTL of JWT-SVIDs issued using this WorkloadIdentity. If a JWT-SVID is requested with a TTL greater than this value, then the returned JWT-SVID will have a TTL of this value. Defaults to 24 hours. The maximum this value can be set to is 24 hours.
format:
durationx509 object
Configuration specific to X509-SVIDs.
dns_sans
[]string
The DNS Subject Alternative Names (SANs) that should be included in an X509-SVID issued using this WorkloadIdentity. Each entry in this list supports templating using attributes.
maximum_ttl
string
Control the maximum TTL of X509-SVIDs issued using this WorkloadIdentity. If a X509-SVID is requested with a TTL greater than this value, then the returned X509-SVID will have a TTL of this value. Defaults to 24 hours. The maximum this value can be set to is 14 days.
format:
durationsubject_template object
Used to configure the Subject Distinguished Name (DN) of the X509-SVID. In most circumstances, it is recommended to prefer relying on the SPIFFE ID encoded in the URI SAN. However, the Subject DN may be needed to support legacy systems designed for X509 and not SPIFFE/WIMSE. If not provided, the X509-SVID will be issued with an empty Subject DN.
common_name
string
Common Name (CN) - 2.5.4.3 If empty, the RDN will be omitted from the DN.
organization
string
Organization (O) - 2.5.4.10 If empty, the RDN will be omitted from the DN.
organizational_unit
string
Organizational Unit (OU) - 2.5.4.11 If empty, the RDN will be omitted from the DN.
status object
Status defines the observed state of the Teleport resource
conditions []object
Conditions represent the latest available observations of an object's state
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
teleportResourceID
integer
format:
int64No matches. Try .spec.rules for an exact path