Infisical Kubernetes Auth API
The Kubernetes Auth API from Infisical — 2 operation(s) for kubernetes auth.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/infisical-kubernetes-auth-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Infisical Admin Kubernetes Auth API
description: List of all available APIs that can be consumed
version: 0.0.1
servers:
- url: https://us.infisical.com
description: Production server (US)
- url: https://eu.infisical.com
description: Production server (EU)
- url: http://localhost:8080
description: Local server
tags:
- name: Kubernetes Auth
paths:
/api/v1/auth/kubernetes-auth/login:
post:
operationId: loginWithKubernetesAuth
tags:
- Kubernetes Auth
description: Login with Kubernetes Auth for machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
identityId:
type: string
description: The ID of the machine identity to login.
jwt:
type: string
organizationSlug:
type: string
minLength: 1
maxLength: 64
description: When set, this will scope the login session to the specified organization the machine identity has access to. If omitted, the session defaults to the organization where the machine identity was created in.
required:
- identityId
- jwt
additionalProperties: false
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
accessToken:
type: string
expiresIn:
type: number
accessTokenMaxTTL:
type: number
tokenType:
type: string
enum:
- Bearer
required:
- accessToken
- expiresIn
- accessTokenMaxTTL
- tokenType
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
/api/v1/auth/kubernetes-auth/identities/{identityId}:
post:
operationId: attachKubernetesAuth
tags:
- Kubernetes Auth
description: Attach Kubernetes Auth configuration onto machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
kubernetesHost:
type:
- string
- 'null'
minLength: 1
description: The host string, host:port pair, or URL to the base of the Kubernetes API server.
caCert:
type: string
description: The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Required when verifyTlsCertificate is true. Supplying a non-empty caCert always implies verifyTlsCertificate=true; explicitly setting the toggle to false in the same request is rejected.
verifyTlsCertificate:
type: boolean
description: Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate. When true, caCert is required. When false, the connection is still over HTTPS but the API server's certificate is not verified, and caCert must be empty. If omitted, defaults to true when caCert is provided and false otherwise.
tokenReviewerJwt:
type: string
description: Optional JWT token for accessing Kubernetes TokenReview API. If provided, this long-lived token will be used to validate service account tokens during authentication. If omitted, the client's own JWT will be used instead, which requires the client to have the system:auth-delegator ClusterRole binding.
tokenReviewMode:
type: string
enum:
- api
- gateway
default: api
description: 'The mode to use for token review. Must be one of: ''api'', ''gateway''. If gateway is selected, the gateway must be deployed in Kubernetes, and the gateway must have the system:auth-delegator ClusterRole binding.'
allowedNamespaces:
type: string
description: The comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.
allowedNames:
type: string
description: The comma-separated list of trusted service account names that can authenticate with Infisical.
allowedAudience:
type: string
description: The optional audience claim that the service account JWT token must have to authenticate with Infisical.
gatewayId:
type:
- string
- 'null'
format: uuid
description: The ID of the gateway to use when performing kubernetes API requests.
gatewayPoolId:
type:
- string
- 'null'
format: uuid
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
default:
- ipAddress: 0.0.0.0/0
- ipAddress: ::/0
description: The IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The lifetime for an access token in seconds.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
default: 2592000
description: The maximum lifetime for an access token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
default: 0
description: The maximum number of times that an access token can be used.
required:
- kubernetesHost
- allowedNamespaces
- allowedNames
- allowedAudience
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to attach the configuration onto.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type:
- string
- 'null'
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type:
- string
- 'null'
format: uuid
gatewayPoolId:
type:
- string
- 'null'
format: uuid
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type:
- string
- 'null'
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
patch:
operationId: updateKubernetesAuth
tags:
- Kubernetes Auth
description: Update Kubernetes Auth configuration on machine identity
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
kubernetesHost:
type:
- string
- 'null'
minLength: 1
description: The new host string, host:port pair, or URL to the base of the Kubernetes API server.
caCert:
type: string
description: The new PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Required when verifyTlsCertificate is true. Supplying a non-empty caCert always implies verifyTlsCertificate=true; the update is rejected if the resulting effective state would store a CA together with verifyTlsCertificate=false.
verifyTlsCertificate:
type: boolean
description: Whether to verify the Kubernetes API server's TLS certificate against the configured CA certificate. When true, caCert is required. When false, the connection is still over HTTPS but the API server's certificate is not verified, and the resulting effective CA must be empty. If omitted while supplying a non-empty caCert in the same update, the toggle is auto-promoted to true; otherwise the stored value is preserved.
tokenReviewerJwt:
type:
- string
- 'null'
description: Optional JWT token for accessing Kubernetes TokenReview API. If provided, this long-lived token will be used to validate service account tokens during authentication. If omitted, the client's own JWT will be used instead, which requires the client to have the system:auth-delegator ClusterRole binding.
tokenReviewMode:
type: string
enum:
- api
- gateway
description: 'The mode to use for token review. Must be one of: ''api'', ''gateway''. If gateway is selected, the gateway must be deployed in Kubernetes, and the gateway must have the system:auth-delegator ClusterRole binding.'
allowedNamespaces:
type: string
description: The new comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.
allowedNames:
type: string
description: The new comma-separated list of trusted service account names that can authenticate with Infisical.
allowedAudience:
type: string
description: The new optional audience claim that the service account JWT token must have to authenticate with Infisical.
gatewayId:
type:
- string
- 'null'
format: uuid
description: The ID of the gateway to use when performing kubernetes API requests.
gatewayPoolId:
type:
- string
- 'null'
format: uuid
accessTokenTrustedIps:
type: array
items:
type: object
properties:
ipAddress:
type: string
required:
- ipAddress
additionalProperties: false
minItems: 1
description: The new IPs or CIDR ranges that access tokens can be used from.
accessTokenTTL:
type: integer
minimum: 0
maximum: 315360000
description: The new lifetime for an acccess token in seconds.
accessTokenNumUsesLimit:
type: integer
minimum: 0
description: The new maximum number of times that an access token can be used.
accessTokenMaxTTL:
type: integer
minimum: 0
maximum: 315360000
description: The new maximum lifetime for an acccess token in seconds.
additionalProperties: false
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to update the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type:
- string
- 'null'
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type:
- string
- 'null'
format: uuid
gatewayPoolId:
type:
- string
- 'null'
format: uuid
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type:
- string
- 'null'
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 401
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'403':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 403
message:
type: string
details: {}
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'404':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 404
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'422':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 422
message: {}
error:
type: string
required:
- reqId
- statusCode
- error
additionalProperties: false
'500':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 500
message:
type: string
error:
type: string
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
get:
operationId: getKubernetesAuth
tags:
- Kubernetes Auth
description: Retrieve Kubernetes Auth configuration on machine identity
parameters:
- schema:
type: string
in: path
name: identityId
required: true
description: The ID of the machine identity to retrieve the auth method for.
security:
- bearerAuth: []
responses:
'200':
description: Default Response
content:
application/json:
schema:
type: object
properties:
identityKubernetesAuth:
type: object
properties:
id:
type: string
format: uuid
accessTokenTTL:
type: number
default: 7200
accessTokenMaxTTL:
type: number
default: 7200
accessTokenNumUsesLimit:
type: number
default: 0
accessTokenTrustedIps: {}
createdAt:
type: string
format: date-time
updatedAt:
type: string
format: date-time
tokenReviewMode:
type: string
default: api
identityId:
type: string
format: uuid
kubernetesHost:
type:
- string
- 'null'
allowedNamespaces:
type: string
allowedNames:
type: string
allowedAudience:
type: string
gatewayId:
type:
- string
- 'null'
format: uuid
gatewayPoolId:
type:
- string
- 'null'
format: uuid
verifyTlsCertificate:
type: boolean
default: false
caCert:
type: string
tokenReviewerJwt:
type:
- string
- 'null'
required:
- id
- createdAt
- updatedAt
- identityId
- allowedNamespaces
- allowedNames
- allowedAudience
- caCert
additionalProperties: false
required:
- identityKubernetesAuth
additionalProperties: false
'400':
description: Default Response
content:
application/json:
schema:
type: object
properties:
reqId:
type: string
statusCode:
type: number
enum:
- 400
message:
type: string
error:
type: string
details: {}
required:
- reqId
- statusCode
- message
- error
additionalProperties: false
'401':
description: Default Response
content:
applicatio
# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/infisical/refs/heads/main/openapi/infisical-kubernetes-auth-api-openapi.yml