# kube-apiserver Configuration (v1)

kube-apiserver Configuration (v1)Package v1 is the v1 version of the API.Resource TypesAdmissionConfigurationAuthorizationConfigurationEncryptionConfigurationAdmissionConfigurationAdmissionConfiguration provides versioned configuration for admission controllers.FieldDescriptionapiVersionstringapiserver.config.k8s.io/v1kindstringAdmissionConfigurationplugins[]AdmissionPluginConfigurationPlugins allows specifying a configuration per admission control plugin.AuthorizationConfigurationFieldDescriptionapiVersionstringapiserver.config.k8s.io/v1kindstringAuthorizationConfigurationauthorizers [Required][]AuthorizerConfigurationAuthorizers is an ordered list of authorizers to authorize requests against. This is similar to the --authorization-modes kube-apiserver flag Must be at least one.EncryptionConfigurationEncryptionConfiguration stores the complete configuration for encryption providers. It also allows the use of wildcards to specify the resources that should be encrypted. Use '*.<group>' to encrypt all resources within a group or '*.*' to encrypt all resources. '*.' can be used to encrypt all resource in the core group. '*.*' will encrypt all resources, even custom resources that are added after API server start. Use of wildcards that overlap within the same resource list or across multiple entries are not allowed since part of the configuration would be ineffective. Resource lists are processed in order, with earlier lists taking precedence.Example:kind: EncryptionConfiguration apiVersion: apiserver.config.k8s.io/v1 resources: - resources: - events providers: - identity: {} # do not encrypt events even though *.* is specified below - resources: - secrets - configmaps - pandas.awesome.bears.example providers: - aescbc: keys: - name: key1 secret: c2VjcmV0IGlzIHNlY3VyZQ== - resources: - '*.apps' providers: - aescbc: keys: - name: key2 secret: c2VjcmV0IGlzIHNlY3VyZSwgb3IgaXMgaXQ/Cg== - resources: - '*.*' providers: - aescbc: keys: - name: key3 secret: c2VjcmV0IGlzIHNlY3VyZSwgSSB0aGluaw== FieldDescriptionapiVersionstringapiserver.config.k8s.io/v1kindstringEncryptionConfigurationresources [Required][]ResourceConfigurationresources is a list containing resources, and their corresponding encryption providers.AESConfigurationAppears in:ProviderConfigurationAESConfiguration contains the API configuration for an AES transformer.FieldDescriptionkeys [Required][]Keykeys is a list of keys to be used for creating the AES transformer. Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.AdmissionPluginConfigurationAppears in:AdmissionConfigurationAdmissionPluginConfiguration provides the configuration for a single plug-in.FieldDescriptionname [Required]stringName is the name of the admission controller. It must match the registered admission plugin name.pathstringPath is the path to a configuration file that contains the plugin's configurationconfigurationk8s.io/apimachinery/pkg/runtime.UnknownConfiguration is an embedded configuration object to be used as the plugin's configuration. If present, it will be used instead of the path to the configuration file.AuthorizerConfigurationAppears in:AuthorizationConfigurationFieldDescriptiontype [Required]stringType refers to the type of the authorizer "Webhook" is supported in the generic API server Other API servers may support additional authorizer types like Node, RBAC, ABAC, etc.name [Required]stringName used to describe the webhook This is explicitly used in monitoring machinery for metrics Note: Names must be DNS1123 labels like myauthorizername or subdomains like myauthorizer.example.domain Required, with no defaultwebhook [Required]WebhookConfigurationWebhook defines the configuration for a Webhook authorizer Must be defined when Type=Webhook Must not be defined when Type!=WebhookIdentityConfigurationAppears in:ProviderConfigurationIdentityConfiguration is an empty struct to allow identity transformer in provider configuration.KMSConfigurationAppears in:ProviderConfigurationKMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.FieldDescriptionapiVersionstringapiVersion of KeyManagementServicename [Required]stringname is the name of the KMS plugin to be used.cachesizeint32cachesize is the maximum number of secrets which are cached in memory. The default value is 1000. Set to a negative value to disable caching. This field is only allowed for KMS v1 providers.endpoint [Required]stringendpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".timeoutmeta/v1.Durationtimeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.KeyAppears in:AESConfigurationSecretboxConfigurationKey contains name and secret of the provided key for a transformer.FieldDescriptionname [Required]stringname is the name of the key to be used while storing data to disk.secret [Required]stringsecret is the actual key, encoded in base64.ProviderConfigurationAppears in:ResourceConfigurationProviderConfiguration stores the provided configuration for an encryption provider.FieldDescriptionaesgcm [Required]AESConfigurationaesgcm is the configuration for the AES-GCM transformer.aescbc [Required]AESConfigurationaescbc is the configuration for the AES-CBC transformer.secretbox [Required]SecretboxConfigurationsecretbox is the configuration for the Secretbox based transformer.identity [Required]IdentityConfigurationidentity is the (empty) configuration for the identity transformer.kms [Required]KMSConfigurationkms contains the name, cache size and path to configuration file for a KMS based envelope transformer.ResourceConfigurationAppears in:EncryptionConfigurationResourceConfiguration stores per resource configuration.FieldDescriptionresources [Required][]stringresources is a list of kubernetes resources which have to be encrypted. The resource names are derived from resource or resource.group of the group/version/resource. eg: pandas.awesome.bears.example is a custom resource with 'group': awesome.bears.example, 'resource': pandas. Use '*.*' to encrypt all resources and '*.<group>' to encrypt all resources in a specific group. eg: '*.awesome.bears.example' will encrypt all resources in the group 'awesome.bears.example'. eg: '*.' will encrypt all resources in the core group (such as pods, configmaps, etc).providers [Required][]ProviderConfigurationproviders is a list of transformers to be used for reading and writing the resources to disk. eg: aesgcm, aescbc, secretbox, identity, kms.SecretboxConfigurationAppears in:ProviderConfigurationSecretboxConfiguration contains the API configuration for an Secretbox transformer.FieldDescriptionkeys [Required][]Keykeys is a list of keys to be used for creating the Secretbox transformer. Each key has to be 32 bytes long.WebhookConfigurationAppears in:AuthorizerConfigurationFieldDescriptionauthorizedTTL [Required]meta/v1.DurationThe duration to cache 'authorized' responses from the webhook authorizer. Same as setting --authorization-webhook-cache-authorized-ttl flag Default: 5m0sunauthorizedTTL [Required]meta/v1.DurationThe duration to cache 'unauthorized' responses from the webhook authorizer. Same as setting --authorization-webhook-cache-unauthorized-ttl flag Default: 30stimeout [Required]meta/v1.DurationTimeout for the webhook request Maximum allowed value is 30s. Required, no default value.subjectAccessReviewVersion [Required]stringThe API version of the authorization.k8s.io SubjectAccessReview to send to and expect from the webhook. Same as setting --authorization-webhook-version flag Valid values: v1beta1, v1 Required, no default valuematchConditionSubjectAccessReviewVersion [Required]stringMatchConditionSubjectAccessReviewVersion specifies the SubjectAccessReview version the CEL expressions are evaluated against Valid values: v1 Required, no default valuefailurePolicy [Required]stringControls the authorization decision when a webhook request fails to complete or returns a malformed response or errors evaluating matchConditions. Valid values:NoOpinion: continue to subsequent authorizers to see if one of them allows the requestDeny: reject the request without consulting subsequent authorizers Required, with no default.connectionInfo [Required]WebhookConnectionInfoConnectionInfo defines how we talk to the webhookmatchConditions [Required][]WebhookMatchConditionmatchConditions is a list of conditions that must be met for a request to be sent to this webhook. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.The exact matching logic is (in order):If at least one matchCondition evaluates to FALSE, then the webhook is skipped.If ALL matchConditions evaluate to TRUE, then the webhook is called.If at least one matchCondition evaluates to an error (but none are FALSE):If failurePolicy=Deny, then the webhook rejects the requestIf failurePolicy=NoOpinion, then the error is ignored and the webhook is skippedWebhookConnectionInfoAppears in:WebhookConfigurationFieldDescriptiontype [Required]stringControls how the webhook should communicate with the server. Valid values:KubeConfigFile: use the file specified in kubeConfigFile to locate the server.InClusterConfig: use the in-cluster configuration to call the SubjectAccessReview API hosted by kube-apiserver. This mode is not allowed for kube-apiserver.kubeConfigFile [Required]stringPath to KubeConfigFile for connection info Required, if connectionInfo.Type is KubeConfigWebhookMatchConditionAppears in:WebhookConfigurationFieldDescriptionexpression [Required]stringexpression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the SubjectAccessReview in v1 version. If version specified by subjectAccessReviewVersion in the request variable is v1beta1, the contents would be converted to the v1 version before evaluating the CEL expression.'resourceAttributes' describes information for a resource access request and is unset for non-resource requests. e.g. has(request.resourceAttributes) && request.resourceAttributes.namespace == 'default''nonResourceAttributes' describes information for a non-resource access request and is unset for resource requests. e.g. has(request.nonResourceAttributes) && request.nonResourceAttributes.path == '/healthz'.'user' is the user to test for. e.g. request.user == 'alice''groups' is the groups to test for. e.g. ('group1' in request.groups)'extra' corresponds to the user.Info.GetExtra() method from the authenticator.'uid' is the information about the requesting user. e.g. request.uid == '1'Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.