Skip to content

Commit fdd6716

Browse files
tengqmtengqm
committed
Add kubelet credentialprovider API reference
1 parent c67d45d commit fdd6716

File tree

3 files changed

+195
-1
lines changed

3 files changed

+195
-1
lines changed

‎content/en/docs/reference/_index.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,19 +66,20 @@ client libraries:
6666

6767
* List of [ports and protocols](/docs/reference/ports-and-protocols/) that
6868
should be open on control plane and worker nodes
69+
6970
## Config APIs
7071

7172
This section hosts the documentation for "unpublished" APIs which are used to
7273
configure kubernetes components or tools. Most of these APIs are not exposed
7374
by the API server in a RESTful way though they are essential for a user or an
7475
operator to use or manage a cluster.
7576

76-
7777
* [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/)
7878
* [kube-apiserver configuration (v1)](/docs/reference/config-api/apiserver-config.v1/)
7979
* [kube-apiserver encryption (v1)](/docs/reference/config-api/apiserver-encryption.v1/)
8080
* [kubelet configuration (v1alpha1)](/docs/reference/config-api/kubelet-config.v1alpha1/) and
8181
[kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/)
82+
* [kubelet credential providers (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/)
8283
* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) and
8384
[kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/)
8485
* [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/)

‎content/en/docs/reference/config-api/kubelet-credentialprovider.v1alpha1.md

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
---
2+
title: Kubelet CredentialProvider (v1alpha1)
3+
content_type: tool-reference
4+
package: credentialprovider.kubelet.k8s.io/v1alpha1
5+
auto_generated: true
6+
---
7+
8+
9+
## Resource Types
10+
11+
12+
- [CredentialProviderRequest](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest)
13+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
14+
15+
16+
17+
18+
## `CredentialProviderRequest` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderRequest}
19+
20+
21+
22+
23+
24+
CredentialProviderRequest includes the image that the kubelet requires authentication for.
25+
Kubelet will pass this request object to the plugin via stdin. In general, plugins should
26+
prefer responding with the same apiVersion they were sent.
27+
28+
<table class="table">
29+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
30+
<tbody>
31+
32+
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
33+
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderRequest</code></td></tr>
34+
35+
36+
37+
38+
<tr><td><code>image</code> <B>[Required]</B><br/>
39+
<code>string</code>
40+
</td>
41+
<td>
42+
image is the container image that is being pulled as part of the
43+
credential provider plugin request. Plugins may optionally parse the image
44+
to extract any information required to fetch credentials.</td>
45+
</tr>
46+
47+
48+
</tbody>
49+
</table>
50+
51+
52+
53+
## `CredentialProviderResponse` {#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse}
54+
55+
56+
57+
58+
59+
CredentialProviderResponse holds credentials that the kubelet should use for the specified
60+
image provided in the original request. Kubelet will read the response from the plugin via stdout.
61+
This response should be set to the same apiVersion as CredentialProviderRequest.
62+
63+
<table class="table">
64+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
65+
<tbody>
66+
67+
<tr><td><code>apiVersion</code><br/>string</td><td><code>credentialprovider.kubelet.k8s.io/v1alpha1</code></td></tr>
68+
<tr><td><code>kind</code><br/>string</td><td><code>CredentialProviderResponse</code></td></tr>
69+
70+
71+
72+
73+
<tr><td><code>cacheKeyType</code> <B>[Required]</B><br/>
74+
<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType"><code>PluginCacheKeyType</code></a>
75+
</td>
76+
<td>
77+
cacheKeyType indiciates the type of caching key to use based on the image provided
78+
in the request. There are three valid values for the cache key type: Image, Registry, and
79+
Global. If an invalid value is specified, the response will NOT be used by the kubelet.</td>
80+
</tr>
81+
82+
83+
<tr><td><code>cacheDuration</code><br/>
84+
<a href="https://godoc.org/k8s.io/apimachinery/pkg/apis/meta/v1#Duration"><code>meta/v1.Duration</code></a>
85+
</td>
86+
<td>
87+
cacheDuration indicates the duration the provided credentials should be cached for.
88+
The kubelet will use this field to set the in-memory cache duration for credentials
89+
in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in
90+
CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.</td>
91+
</tr>
92+
93+
94+
<tr><td><code>auth</code><br/>
95+
<a href="#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig"><code>map[string]k8s.io/kubelet/pkg/apis/credentialprovider/v1alpha1.AuthConfig</code></a>
96+
</td>
97+
<td>
98+
auth is a map containing authentication information passed into the kubelet.
99+
Each key is a match image string (more on this below). The corresponding authConfig value
100+
should be valid for all images that match against this key. A plugin should set
101+
this field to null if no valid credentials can be returned for the requested image.
102+
103+
Each key in the map is a pattern which can optionally contain a port and a path.
104+
Globs can be used in the domain, but not in the port or the path. Globs are supported
105+
as subdomains like '&lowast;.k8s.io' or 'k8s.&lowast;.io', and top-level-domains such as 'k8s.&lowast;'.
106+
Matching partial subdomains like 'app&lowast;.k8s.io' is also supported. Each glob can only match
107+
a single subdomain segment, so &lowast;.io does not match &lowast;.k8s.io.
108+
109+
The kubelet will match images against the key when all of the below are true:
110+
- Both contain the same number of domain parts and each part matches.
111+
- The URL path of an imageMatch must be a prefix of the target image URL path.
112+
- If the imageMatch contains a port, then the port must match in the image as well.
113+
114+
When multiple keys are returned, the kubelet will traverse all keys in reverse order so that:
115+
- longer keys come before shorter keys with the same prefix
116+
- non-wildcard keys come before wildcard keys with the same prefix.
117+
118+
For any given match, the kubelet will attempt an image pull with the provided credentials,
119+
stopping after the first successfully authenticated pull.
120+
121+
Example keys:
122+
- 123456789.dkr.ecr.us-east-1.amazonaws.com
123+
- &lowast;.azurecr.io
124+
- gcr.io
125+
- &lowast;.&lowast;.registry.io
126+
- registry.io:8080/path</td>
127+
</tr>
128+
129+
130+
</tbody>
131+
</table>
132+
133+
134+
135+
## `AuthConfig` {#credentialprovider-kubelet-k8s-io-v1alpha1-AuthConfig}
136+
137+
138+
139+
140+
**Appears in:**
141+
142+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
143+
144+
145+
AuthConfig contains authentication information for a container registry.
146+
Only username/password based authentication is supported today, but more authentication
147+
mechanisms may be added in the future.
148+
149+
<table class="table">
150+
<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
151+
<tbody>
152+
153+
154+
155+
<tr><td><code>username</code> <B>[Required]</B><br/>
156+
<code>string</code>
157+
</td>
158+
<td>
159+
username is the username used for authenticating to the container registry
160+
An empty username is valid.</td>
161+
</tr>
162+
163+
164+
<tr><td><code>password</code> <B>[Required]</B><br/>
165+
<code>string</code>
166+
</td>
167+
<td>
168+
password is the password used for authenticating to the container registry
169+
An empty password is valid.</td>
170+
</tr>
171+
172+
173+
</tbody>
174+
</table>
175+
176+
177+
178+
## `PluginCacheKeyType` {#credentialprovider-kubelet-k8s-io-v1alpha1-PluginCacheKeyType}
179+
180+
(Alias of `string`)
181+
182+
183+
**Appears in:**
184+
185+
- [CredentialProviderResponse](#credentialprovider-kubelet-k8s-io-v1alpha1-CredentialProviderResponse)
186+
187+
188+
189+
190+
191+
192+

‎content/en/docs/tasks/kubelet-credential-provider/kubelet-credential-provider.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,4 +152,5 @@ Some example values of `matchImages` patterns are:
152152

153153
* Read the details about `CredentialProviderConfig` in the
154154
[kubelet configuration API (v1alpha1) reference](/docs/reference/config-api/kubelet-config.v1alpha1/).
155+
* Read the [kubelet credential provider API reference (v1alpha1)](/docs/reference/config-api/kubelet-credentialprovider.v1alpha1/).
155156

0 commit comments

Comments
 (0)