Infisical Kubernetes Auth API
The Kubernetes Auth API from Infisical — 2 operation(s) for kubernetes auth.
OpenAPI Specification
openapi: 3.0.3
info:
title: Infisical Admin Kubernetes Auth API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: Kubernetes Auth
paths:
/api/v1/auth/kubernetes-auth/login:
post:
operationId: loginWithKubernetesAuth
tags:
- Kubernetes Auth
description: Login with Kubernetes Auth for machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
identityId:
type: string
description: The ID of the machine identity to login.
jwt:
type: string
organizationSlug:
type: string
minLength: 1
maxLength: 64
description: When set, this will scope the login session to the specified organization the machine identity has access to. If omitted, the session defaults to the organization where the machine identity was created in.
required:
- identityId
- jwt
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
accessToken:
type: string
expiresIn:
type: number
accessTokenMaxTTL:
type: number
tokenType:
type: string
enum:
- Bearer
required:
- accessToken
- expiresIn
- accessTokenMaxTTL
- tokenType
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/auth/kubernetes-auth/identities/{identityId}:
post:
operationId: attachKubernetesAuth
tags:
- Kubernetes Auth
description: Attach Kubernetes Auth configuration onto machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
kubernetesHost:
type: string
minLength: 1
nullable: true
description: The host string, host:port pair, or URL to the base of the Kubernetes API server.
caCert:
type: string
description: The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Required when verifyTlsCertificate is true. Supplying a non-empty caCert always implies verifyTlsCertificate=true; explicitly setting the toggle to false in the same request is rejected.
verifyTlsCertificate:
type: boolean
description: Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate. When true, caCert is required. When false, the connection is still over HTTPS but the API server's certificate is not verified, and caCert must be empty. If omitted, defaults to true when caCert is provided and false otherwise.
tokenReviewerJwt:
type: string
description: Optional JWT token for accessing Kubernetes TokenReview API. If provided, this long-lived token will be used to validate service account tokens during authentication. If omitted, the client's own JWT will be used instead, which requires the client to have the system:auth-delegator ClusterRole binding.
tokenReviewMode:
type: string
enum:
- api
- gateway
default: api
description: 'The mode to use for token review. Must be one of: ''api'', ''gateway''. If gateway is selected, the gateway must be deployed in Kubernetes, and the gateway must have the system:auth-delegator ClusterRole binding.'
allowedNamespaces:
type: string
description: The comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.
allowedNames:
type: string
description: The comma-separated list of trusted service account names that can authenticate with Infisical.
allowedAudience:
type: string
description: The optional audience claim that the service account JWT token must have to authenticate with Infisical.
gatewayId:
type: string
format: uuid
nullable: true
description: The ID of the gateway to use when performing kubernetes API requests.
gatewayPoolId:
type: string
format: uuid
nullable: true
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
default:
- ipAddress: 0.0.0.0/0
- ipAddress: ::/0
description: The IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The lifetime for an access token in seconds.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The maximum lifetime for an access token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
default: 0
description: The maximum number of times that an access token can be used.
required:
- kubernetesHost
- allowedNamespaces
- allowedNames
- allowedAudience
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to attach the configuration onto.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type: string
nullable: true
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type: string
format: uuid
nullable: true
gatewayPoolId:
type: string
format: uuid
nullable: true
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type: string
nullable: true
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
patch:
operationId: updateKubernetesAuth
tags:
- Kubernetes Auth
description: Update Kubernetes Auth configuration on machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
kubernetesHost:
type: string
minLength: 1
nullable: true
description: The new host string, host:port pair, or URL to the base of the Kubernetes API server.
caCert:
type: string
description: The new PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Required when verifyTlsCertificate is true. Supplying a non-empty caCert always implies verifyTlsCertificate=true; the update is rejected if the resulting effective state would store a CA together with verifyTlsCertificate=false.
verifyTlsCertificate:
type: boolean
description: Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate. When true, caCert is required. When false, the connection is still over HTTPS but the API server's certificate is not verified, and the resulting effective CA must be empty. If omitted while supplying a non-empty caCert in the same update, the toggle is auto-promoted to true; otherwise the stored value is preserved.
tokenReviewerJwt:
type: string
nullable: true
description: Optional JWT token for accessing Kubernetes TokenReview API. If provided, this long-lived token will be used to validate service account tokens during authentication. If omitted, the client's own JWT will be used instead, which requires the client to have the system:auth-delegator ClusterRole binding.
tokenReviewMode:
type: string
enum:
- api
- gateway
description: 'The mode to use for token review. Must be one of: ''api'', ''gateway''. If gateway is selected, the gateway must be deployed in Kubernetes, and the gateway must have the system:auth-delegator ClusterRole binding.'
allowedNamespaces:
type: string
description: The new comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.
allowedNames:
type: string
description: The new comma-separated list of trusted service account names that can authenticate with Infisical.
allowedAudience:
type: string
description: The new optional audience claim that the service account JWT token must have to authenticate with Infisical.
gatewayId:
type: string
format: uuid
nullable: true
description: The ID of the gateway to use when performing kubernetes API requests.
gatewayPoolId:
type: string
format: uuid
nullable: true
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
description: The new IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
description: The new lifetime for an acccess token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
description: The new maximum number of times that an access token can be used.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
description: The new maximum lifetime for an acccess token in seconds.
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to update the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type: string
nullable: true
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type: string
format: uuid
nullable: true
gatewayPoolId:
type: string
format: uuid
nullable: true
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type: string
nullable: true
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
get:
operationId: getKubernetesAuth
tags:
- Kubernetes Auth
description: Retrieve Kubernetes Auth configuration on machine identity
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to retrieve the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type: string
nullable: true
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type: string
format: uuid
nullable: true
gatewayPoolId:
type: string
format: uuid
nullable: true
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type: string
nullable: true
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/infisical/refs/heads/main/openapi/infisical-kubernetes-auth-api-openapi.yml