Amazon EKS Eks Identity Provider Configs API

openapi: 3.1.0
info:
  title: Amazon Elastic Kubernetes Service Identity Provider Configs API
  version: '2017-11-01'
  description: Generated from AWS's published Smithy model for Amazon Elastic Kubernetes Service. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://eks.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /clusters/{clusterName}/identity-provider-configs/associate:
    post:
      operationId: AssociateIdentityProviderConfig
      summary: Associate Identity Provider Config
      description: Associates an identity provider configuration to a cluster. If you want to authenticate identities using
        an identity provider, you can create an identity provider configuration and associate it to your cluster. After configuring
        authentication to your cluster you can create Kubernetes Role and ClusterRole objects, assign permissions to them,
        and then bind them to the identities using Kubernetes RoleBinding and ClusterRoleBinding objects. For more information
        see Using RBAC Authorization in the Kubernetes documentation.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssociateIdentityProviderConfigResponse'
        '400':
          description: ClientException; InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssociateIdentityProviderConfigRequest'
      tags:
      - Identity Provider Configs
  /clusters/{clusterName}/identity-provider-configs/describe:
    post:
      operationId: DescribeIdentityProviderConfig
      summary: Describe Identity Provider Config
      description: Describes an identity provider configuration.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeIdentityProviderConfigResponse'
        '400':
          description: ClientException; InvalidParameterException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribeIdentityProviderConfigRequest'
      tags:
      - Identity Provider Configs
  /clusters/{clusterName}/identity-provider-configs/disassociate:
    post:
      operationId: DisassociateIdentityProviderConfig
      summary: Disassociate Identity Provider Config
      description: Disassociates an identity provider configuration from a cluster. If you disassociate an identity provider
        from your cluster, users included in the provider can no longer access the cluster. However, you can still access
        the cluster with IAM principals.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DisassociateIdentityProviderConfigResponse'
        '400':
          description: ClientException; InvalidParameterException; InvalidRequestException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientException'
        '409':
          description: ResourceInUseException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceInUseException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisassociateIdentityProviderConfigRequest'
      tags:
      - Identity Provider Configs
  /clusters/{clusterName}/identity-provider-configs:
    get:
      operationId: ListIdentityProviderConfigs
      summary: List Identity Provider Configs
      description: Lists the identity provider configurations for your cluster.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIdentityProviderConfigsResponse'
        '400':
          description: ClientException; InvalidParameterException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '500':
          description: ServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerException'
        '503':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListIdentityProviderConfigsRequest'
      tags:
      - Identity Provider Configs
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: eks
  schemas:
    AssociateIdentityProviderConfigRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        oidc:
          $ref: '#/components/schemas/OidcIdentityProviderConfigRequest'
        tags:
          type: object
          additionalProperties:
            type: string
          description: Metadata that assists with categorization and organization. Each tag consists of a key and an optional
            value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
      required:
      - clusterName
      - oidc
    AssociateIdentityProviderConfigResponse:
      type: object
      properties:
        update:
          $ref: '#/components/schemas/Update'
        tags:
          type: object
          additionalProperties:
            type: string
          description: The tags for the resource.
    Cancellation:
      type: object
      properties:
        status:
          type: string
          enum:
          - InProgress
          - Failed
          - Successful
          description: The current status of the cancellation. Valid values are InProgress, Failed, and Successful.
        reason:
          type: string
          description: A message providing additional details about the cancellation, such as the reason for the cancellation
            or failure details.
    ClientException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: These errors are usually caused by a client action. Actions can include using an action or resource
            on behalf of an IAM principal that doesn't have permissions to use the action or resource or specifying an identifier
            that is not valid.
    DescribeIdentityProviderConfigRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        identityProviderConfig:
          $ref: '#/components/schemas/IdentityProviderConfig'
      required:
      - clusterName
      - identityProviderConfig
    DescribeIdentityProviderConfigResponse:
      type: object
      properties:
        identityProviderConfig:
          $ref: '#/components/schemas/IdentityProviderConfigResponse'
    DisassociateIdentityProviderConfigRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        identityProviderConfig:
          $ref: '#/components/schemas/IdentityProviderConfig'
        clientRequestToken:
          type: string
          description: A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
      required:
      - clusterName
      - identityProviderConfig
    DisassociateIdentityProviderConfigResponse:
      type: object
      properties:
        update:
          $ref: '#/components/schemas/Update'
    ErrorDetail:
      type: object
      properties:
        errorCode:
          type: string
          enum:
          - SubnetNotFound
          - SecurityGroupNotFound
          - EniLimitReached
          - IpNotAvailable
          - AccessDenied
          - OperationNotPermitted
          - VpcIdNotFound
          - Unknown
          - NodeCreationFailure
          - PodEvictionFailure
          - InsufficientFreeAddresses
          - ClusterUnreachable
          - InsufficientNumberOfReplicas
          - ConfigurationConflict
          - AdmissionRequestDenied
          - UnsupportedAddonModification
          - K8sResourceNotFound
          description: 'A brief description of the error. SubnetNotFound: We couldn''t find one of the subnets associated
            with the cluster. SecurityGroupNotFound: We couldn''t find one of the security groups associated with the cluster.
            EniLimitReached: You have reached the elastic network interface limit for your account. IpNotAvailable: A subnet
            associated with the cluster doesn''t have any available IP addresses. AccessDenied: You don''t have permissions
            to perform the specified operation. OperationNotPermitted: The service role associated with the cluster doesn''t
            have the required access permissions for Amazon EKS. V'
        errorMessage:
          type: string
          description: A more complete description of the error.
        resourceIds:
          type: array
          items:
            type: string
          description: An optional field that contains the resource IDs associated with the error.
    IdentityProviderConfig:
      type: object
      properties:
        type:
          type: string
          description: The type of the identity provider configuration. The only type available is oidc.
        name:
          type: string
          description: The name of the identity provider configuration.
      required:
      - type
      - name
    IdentityProviderConfigResponse:
      type: object
      properties:
        oidc:
          $ref: '#/components/schemas/OidcIdentityProviderConfig'
    ListIdentityProviderConfigsRequest:
      type: object
      properties:
        clusterName:
          type: string
          description: The name of your cluster.
        maxResults:
          type: integer
          description: The maximum number of results, returned in paginated output. You receive maxResults in a single page,
            along with a nextToken response element. You can see the remaining results of the initial request by sending another
            request with the returned nextToken value. This value can be between 1 and 100. If you don't use this parameter,
            100 results and a nextToken value, if applicable, are returned.
        nextToken:
          type: string
          description: The nextToken value returned from a previous paginated request, where maxResults was used and the results
            exceeded the value of that parameter. Pagination continues from the end of the previous results that returned
            the nextToken value. This value is null when there are no more results to return. This token should be treated
            as an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic
            purposes.
      required:
      - clusterName
    ListIdentityProviderConfigsResponse:
      type: object
      properties:
        identityProviderConfigs:
          type: array
          items:
            $ref: '#/components/schemas/IdentityProviderConfig'
          description: The identity provider configurations for the cluster.
        nextToken:
          type: string
          description: The nextToken value to include in a future ListIdentityProviderConfigsResponse request. When the results
            of a ListIdentityProviderConfigsResponse request exceed maxResults, you can use this value to retrieve the next
            page of results. This value is null when there are no more results to return. This token should be treated as
            an opaque identifier that is used only to retrieve the next items in a list and not for other programmatic purposes.
    OidcIdentityProviderConfig:
      type: object
      properties:
        identityProviderConfigName:
          type: string
          description: The name of the configuration.
        identityProviderConfigArn:
          type: string
          description: The ARN of the configuration.
        clusterName:
          type: string
          description: The name of your cluster.
        issuerUrl:
          type: string
          description: The URL of the OIDC identity provider that allows the API server to discover public signing keys for
            verifying tokens.
        clientId:
          type: string
          description: This is also known as audience. The ID of the client application that makes authentication requests
            to the OIDC identity provider.
        usernameClaim:
          type: string
          description: The JSON Web token (JWT) claim that is used as the username.
        usernamePrefix:
          type: string
          description: 'The prefix that is prepended to username claims to prevent clashes with existing names. The prefix
            can''t contain system:'
        groupsClaim:
          type: string
          description: The JSON web token (JWT) claim that the provider uses to return your groups.
        groupsPrefix:
          type: string
          description: 'The prefix that is prepended to group claims to prevent clashes with existing names (such as system:
            groups). For example, the value oidc: creates group names like oidc:engineering and oidc:infra. The prefix can''t
            contain system:'
        requiredClaims:
          type: object
          additionalProperties:
            type: string
          description: The key-value pairs that describe required claims in the identity token. If set, each claim is verified
            to be present in the token with a matching value.
        tags:
          type: object
          additionalProperties:
            type: string
          description: Metadata that assists with categorization and organization. Each tag consists of a key and an optional
            value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
        status:
          type: string
          enum:
          - CREATING
          - DELETING
          - ACTIVE
          description: The status of the OIDC identity provider.
    OidcIdentityProviderConfigRequest:
      type: object
      properties:
        identityProviderConfigName:
          type: string
          description: The name of the OIDC provider configuration.
        issuerUrl:
          type: string
          description: The URL of the OIDC identity provider that allows the API server to discover public signing keys for
            verifying tokens. The URL must begin with https:// and should correspond to the iss claim in the provider's OIDC
            ID tokens. Based on the OIDC standard, path components are allowed but query parameters are not. Typically the
            URL consists of only a hostname, like https://server.example.org or https://example.com. This URL should point
            to the level below .well-known/openid-configuration and must be publicly accessible over the internet.
        clientId:
          type: string
          description: This is also known as audience. The ID for the client application that makes authentication requests
            to the OIDC identity provider.
        usernameClaim:
          type: string
          description: The JSON Web Token (JWT) claim to use as the username. The default is sub, which is expected to be
            a unique identifier of the end user. You can choose other claims, such as email or name, depending on the OIDC
            identity provider. Claims other than email are prefixed with the issuer URL to prevent naming clashes with other
            plug-ins.
        usernamePrefix:
          type: string
          description: The prefix that is prepended to username claims to prevent clashes with existing names. If you do not
            provide this field, and username is a value other than email, the prefix defaults to issuerurl#. You can use the
            value - to disable all prefixing.
        groupsClaim:
          type: string
          description: The JWT claim that the provider uses to return your groups.
        groupsPrefix:
          type: string
          description: 'The prefix that is prepended to group claims to prevent clashes with existing names (such as system:
            groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.'
        requiredClaims:
          type: object
          additionalProperties:
            type: string
          description: The key value pairs that describe required claims in the identity token. If set, each claim is verified
            to be present in the token with a matching value. For the maximum number of claims that you can require, see Amazon
            EKS service quotas in the Amazon EKS User Guide.
      required:
      - identityProviderConfigName
      - issuerUrl
      - clientId
    ResourceInUseException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The specified add-on name is in use.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ResourceNotFoundException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        fargateProfileName:
          type: string
          description: The Fargate profile associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: The Amazon EKS message associated with the exception.
    ServerException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        nodegroupName:
          type: string
          description: The Amazon EKS managed node group associated with the exception.
        addonName:
          type: string
          description: The Amazon EKS add-on name associated with the exception.
        subscriptionId:
          type: string
          description: The Amazon EKS subscription ID with the exception.
        message:
          type: string
          description: These errors are usually caused by a server-side issue.
    ServiceUnavailableException:
      type: object
      properties:
        message:
          type: string
          description: The request has failed due to a temporary failure of the server.
    ThrottlingException:
      type: object
      properties:
        clusterName:
          type: string
          description: The Amazon EKS cluster associated with the exception.
        message:
          type: string
    Update:
      type: object
      properties:
        id:
          type: string
          description: A UUID that is used to track the update.
        status:
          type: string
          enum:
          - InProgress
          - Failed
          - Cancelled
          - Successful
          description: The current status of the update.
        type:
          type: string
          enum:
          - VersionUpdate
          - EndpointAccessUpdate
          - LoggingUpdate
          - ConfigUpdate
          - AssociateIdentityProviderConfig
          - DisassociateIdentityProviderConfig
          - AssociateEncryptionConfig
          - AddonUpdate
          - VpcConfigUpdate
          - AccessConfigUpdate
          - UpgradePolicyUpdate
          - ZonalShiftConfigUpdate
          - AutoModeUpdate
          - RemoteNetworkConfigUpdate
          - DeletionProtectionUpdate
          - CapabilityUpdate
          - ControlPlaneScalingConfigUpdate
          - VendedLogsUpdate
          - ControlPlaneEgressUpdate
          - VersionRollback
          - ControlPlaneComponentConfigUpdate
          - CertificateAuthorityUpdate
          description: The type of the update.
        params:
          type: array
          items:
            $ref: '#/components/schemas/UpdateParam'
          description: A key-value map that contains the parameters associated with the update.
        createdAt:
          type: string
          format: date-time
          description: The Unix epoch timestamp at object creation.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
          description: Any errors associated with a Failed update.
        cancellation:
          $ref: '#/components/schemas/Cancellation'
    UpdateParam:
      type: object
      properties:
        type:
          type: string
          enum:
          - Version
          - PlatformVersion
          - EndpointPrivateAccess
          - EndpointPublicAccess
          - ClusterLogging
          - DesiredSize
          - LabelsToAdd
          - LabelsToRemove
          - TaintsToAdd
          - TaintsToRemove
          - MaxSize
          - MinSize
          - ReleaseVersion
          - PublicAccessCidrs
          - LaunchTemplateName
          - LaunchTemplateVersion
          - IdentityProviderConfig
          - EncryptionConfig
          - AddonVersion
          - ServiceAccountRoleArn
          - ResolveConflicts
          - MaxUnavailable
          - MaxUnavailablePercentage
          - NodeRepairEnabled
          - UpdateStrategy
          - ConfigurationValues
          - SecurityGroups
          - Subnets
          - AuthenticationMode
          - PodIdentityAssociations
          - UpgradePolicy
          - ZonalShiftConfig
          - ComputeConfig
          - StorageConfig
          - KubernetesNetworkConfig
          - RemoteNetworkConfig
          - DeletionProtection
          - NodeRepairConfig
          - RoleArn
          - RoleMappingsToAddOrUpdate
          - RoleMappingsToRemove
          - NetworkAccess
          - VendedLogs
          - UpdatedTier
          - PreviousTier
          - EnableCrossNamespace
          - DisabledServices
          - WarmPoolEnabled
          - WarmPoolMaxGroupPreparedCapacity
          - WarmPoolMinSize
          - WarmPoolState
          - WarmPoolReuseOnScaleIn
          - ControlPlaneEgressMode
          - KubeApiServerConfig
          - KubeSchedulerConfig
          - KubeControllerManagerConfig
          - ActiveCertificateAuthority
          - TrustedCertificateAuthorities
          - CertificateAuthorityId
          - SigningStatus
          description: The keys associated with an update request.
        value:
          type: string
          description: The value of the keys submitted as part of an update request.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/eks/service/2017-11-01/eks-2017-11-01.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)