KRM API iam.gdc.goog/v1

iam.gdc.goog/v1

Contains API Schema definitions for the identity API group.

Package v1 contains API Schema definitions for the iam.gdc.goog v1 API group

ClientAuthConfig

ClientAuthConfig determines the way AIS authenticates itself to the Identity Provider.

Field	Description
`method` string	Type of the ClientAuthentication method. Default method is client_secret_post that sends client_secret in the Token API. Other method supported is private_key_jwt that sends a signed jwt in the Token API. private_key_jwt method requires SigningKey configuration to be valid.
`signatureAlg` string	Signature Algorithm used to compute the JWT. Only supported algorithm at this point is RS256.
`signingKey` ClientAuthSigningKeySecret	SigningKey denotes the parameters required to retrieve the key used to sign the JWT. Key is stored as a kubernetes secret.

ClientAuthSigningKeySecret

ClientAuthSigningKeySecret contains the details of the signing key.

Appears in: - ClientAuthConfig

Field	Description
`name` string	Name of the secret which stores the SigningKey.
`namespace` string	Namespace of the secret which stores the SigningKey.
`kid` string	kid is the unique identifier that represents the signing key. Identity Provider looks up public key corresponding to the kid in order to verify payload.

CustomRole

Represents a template for a zonal CustomRole Custom roles provide fine-grained control over user permissions, unlike predefined roles. This allows organizations to tailor access rights to their specific needs, balancing operational efficiency with security. By adhering to the principle of least privilege, custom roles significantly enhance security and protect sensitive data.

Appears in: - CustomRoleList

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`CustomRole`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` CustomRoleSpec
`status` CustomRoleStatus

CustomRoleList

Contains a list of CustomRole resource

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`CustomRoleList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` CustomRole array

CustomRoleMetadata

Represents the data necessary to create a Custom Role

Appears in: - CustomRoleSpec

Field	Description
`scope` CustomRoleScopeType	scope of the custom role created which can either be organization or project
`roleNamespaces` string array	namespace of the role (optional) only required for role deployment if: case 1: when scope is project then it denotes the project namespaces case 2: when scope is project and roleNamespaces contain ['*'] then it denotes all project namespaces case 3: when scope is organization and deployment roleType is role not clusterRole then it denotes literal namespaces
`title` string	title is a friendly title for the role, such as "My Company Admin".
`description` string	description is a short description of the role, such as "My custom role description".
`id` string	id is the name of the role, such as "my-company-admin".
`stage` StageType	stage indicates the stage of a role in the launch lifecycle which can either be [ALPHA, BETA, GA, DISABLED]

CustomRoleSpec

Defines the CustomRole data in the ClusterRoleTemplate resource

Appears in: - CustomRole

Field	Description
`metadata` CustomRoleMetadata	Refer to Kubernetes API documentation for fields of `metadata`.
`zonalRules` PolicyRule array
`globalRules` PolicyRule array

CustomRoleStatus

Provides a status of CustomRole

Appears in: - CustomRole

Field	Description
`conditions` Condition array	Conditions represents the observations of this Custom role overall state
`propagationInfo` PropagationInfo	propagation information of converted template for zonal role template conversion

DecryptionKeysSecret

DecryptionKeysSecret specifies the namespace, and name of a kubernetes secret that holds the decryption keys for decrypting the encrypted tokens. kid is the unique key identifier for a decryption key that's used by the Provider to let the token recipient know which decryption key needs to be used for decrypting the token(s).

Appears in: - EncryptedTokensConfig

Field	Description
`name` string	Kubernetes Name of the secret.
`namespace` string	Kubernetes NameSpace of the secret.
`kid` string	kid is the unique key identifier that represents a decryption key.

EncryptedAssertionConfig

EncryptedAssertionConfig provides configuration for the SAML assertion encryption feature.

Appears in: - SAMLProviderConfig

Field	Description
`enabled` boolean	Specifies if SAML assertions must be decrypted before being parsed. The assertion decryption feature is only enabled when this is set to true.
`decryptionKeys` KubernetesSecretConfig array	Kubernetes secret where the Assertion encryption certificate, and the assertion decryption key are stored. This secret needs to be of type TLS. (see: https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets).

EncryptedTokensConfig

EncryptedTokensConfig provides configuration for the OIDC token encryption feature.

Appears in: - OIDCProviderConfig

Field	Description
`enabled` boolean	Specifies if OIDC token(s) must be decrypted before being parsed. The token decryption feature is only enabled when this field is set to true.
`decryptionKeys` DecryptionKeysSecret array	Kubernetes secret where the token decryption key(s) is/are stored.

IdentityProviderConfig

Represents a configuration for an identity provider that supports OIDC or SAML.

Appears in: - IdentityProviderConfigList

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`IdentityProviderConfig`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` IdentityProviderConfigSpec
`status` IdentityProviderConfigStatus

IdentityProviderConfigList

Contains a list of IdentityProviderConfig resources.

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`IdentityProviderConfigList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` IdentityProviderConfig array

IdentityProviderConfigSpec

Provides the specification, or desired state, of an IdentityProviderConfig resource. Either OIDCConfig or SAMLConfig has to be provided but not both.

Appears in: - IdentityProviderConfig

Field	Description
`oidc` OIDCProviderConfig	OIDC specific configuration.
`saml` SAMLProviderConfig	SAML specific configuration.

IdentityProviderConfigStatus

Provides the status of an IdentityProviderConfig resource.

Appears in: - IdentityProviderConfig

Field	Description
`conditions` Condition array
`errorStatus` ErrorStatus	The most recent errors with the observed times included.

KubernetesSecretConfig

KubernetesSecretConfig specifies the namespace, and name of a kubernetes secret.

Appears in: - EncryptedAssertionConfig - SignedRequestConfig

Field	Description
`name` string	Kubernetes Name of the secret.
`namespace` string	Kubernetes NameSpace of the secret.

OIDCProviderConfig

OIDCProviderConfig contains parameters needed for OIDC Authentication flow.

Appears in: - IdentityProviderConfigSpec

Field	Description
`clientID` string	ClientID is an ID for OIDC client application.
`clientSecret` string	ClientSecret is the shared secret between OIDC client application and OIDC provider.
`certificateAuthorityData` string	CertificateAuthorityData contains a standard Base64 encoded, PEM formatted certificate authority certificate for OIDC provider.
`issuerURI` string	URI for the OIDC provider. This URI is the prefix of "/.well-known/openid-configuration". For example, if the IDP's well-known configuration endpoint is "https://{oauth-provider-hostname}/.well-known/openid-configuration", then the Issuer URI is "https://{oauth-provider-hostname}".
`kubectlRedirectURI` string	KubectlRedirectURI is the URI to redirect users authenticating to an OIDC provider with the kubectl plugin.
`cloudConsoleRedirectURI` string	CloudConsoleRedirectURI is the URI to redirect users going through the OAuth flow using cloud console.
`scopes` string	Comma-separated list of identifiers used to specify what access privileges are being requested in addition to "openid" scope.
`extraParams` string	Comma-separated list of key-value pairs that will be query-encoded and sent with the authentication endpoint request.
`enableAccessToken` boolean	Flag that denotes if the access-token should be included in the request as part of the bearer token by `gcloud anthos auth login` and `kubectl oidc login`. Defaults to false.
`userClaim` string	Name of the claim in the OIDC ID Token that holds the username. If this is missing from the ID Token, authentication will fail.
`userPrefix` string	Prefix to prepend to the user name.
`groupsClaim` string	Name of the claim in the OIDC ID Token that holds the user's groups information.
`groupPrefix` string	Prefix to prepend to the group name.
`deployCloudConsoleProxy` boolean	Flag to denote if HTTP reverse proxy is used for connecting to authentication provider. This should be set to true when authentication provider is not reachable by Google Cloud Console.
`attributeMapping` object (keys:string, values:string)	Optional Common Expression Language (CEL) for mapping user attributes from the identity provider to the web application.
`clientAuthParams` ClientAuthConfig	Optional ClientAuth params define the way AIS authenticates itself while sending the Token API. Currently used during authorization code flow.
`encryptedTokens` EncryptedTokensConfig	Optional configuration for the OIDC encrypted token feature.

PropagationInfo

Provides the information of converted role template

Appears in: - CustomRoleStatus

Field	Description
`roleName` string	name of the role
`roleType` RoleType	type of the role, it can be [role, clusterRole, projectRole, organizationRole]
`namespaces` string array	namespaces of the role where role deployment will occur

SAMLProviderConfig

SAMLProviderConfig contains parameters needed for SAML Authentication flow.

Appears in: - IdentityProviderConfigSpec

Field	Description
`idpEntityID` string	The SAML entity ID for the SAML provider, specified in a URI format. For example: https://www.idp.com/saml.
`idpSingleSignOnURI` string	The URI to the SAML provider's SSO endpoint. For example: https://www.idp.com/saml/sso.
`idpCertificateDataList` string array	The IDP certificates that will be used to verify the SAML response. These certificates should be standard Base64 encoded, and PEM formatted. Only a maximum of 2 certificates are supported to facilitate IDP certificate rotation.
`userAttribute` string	Name of the attribute in the SAML response that holds the username. If this attribute is missing from the SAML response, authentication will fail.
`userPrefix` string	Optional prefix to prepend to the user name.
`groupsAttribute` string	Name of the attribute in the SAML response that holds the user's groups.
`groupPrefix` string	Optional prefix to prepend to each group name.
`attributeMapping` object (keys:string, values:string)	Optional Common Expression Language (CEL) for mapping user attributes from the identity provider to the web application.
`encryptedAssertions` EncryptedAssertionConfig	Optional configuration for the SAML encrypted assertion feature.
`signedRequests` SignedRequestConfig	Optional configuration for the SAML authentication request signing feature.

SignedRequestConfig

SignedRequestConfig provides configuration for the SAML authentication request signing feature.

Appears in: - SAMLProviderConfig

Field	Description
`enabled` boolean	Specifies if SAML authentication request must be signed. The signed request feature is only enabled when this is set to true.
`signingKey` KubernetesSecretConfig	Kubernetes secret where the SAML request signing certificate key pair is stored. This secret needs to be of type TLS. (see: https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets).

StandardClusterRole

Represents a project resource that propagates the ClusterRole configuration to all vanilla clusters under the project. The namespace of the StandardClusterRole resource corresponds to the project.

Appears in: - StandardClusterRoleList

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`StandardClusterRole`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` StandardClusterRoleSpec
`status` StandardClusterRoleStatus

StandardClusterRoleBinding

Represents a project resource that propagates the ClusterRoleBinding resource configuration to all vanilla clusters in the same project. The namespace for the StandardClusterRoleBinding resource corresponds to the project.

Appears in: - StandardClusterRoleBindingList

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`StandardClusterRoleBinding`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` StandardClusterRoleBindingSpec
`status` StandardClusterRoleBindingStatus

StandardClusterRoleBindingList

Contains a list of StandardClusterRoleBinding resources.

Field	Description
`apiVersion` string	`iam.gdc.goog/v1`
`kind` string	`StandardClusterRoleBindingList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` StandardClusterRoleBinding array

StandardClusterRoleBindingSpec

Defines the specification of the StandardClusterRoleBinding resource. It is the same definition as a native ClusterRoleBinding definition.

Appears in: - StandardClusterRoleBinding

Field	Description
`subjects` Subject array	The subjects of the `RoleBinding` resource created in the cluster.
`roleRef` RoleRef	The `RoleRef` resource of the `RoleBinding` object to create in the cluster.

StandardClusterRoleBindingStatus

Defines the observed state of the StandardClusterRoleBinding resource.