kube-apiserver Configuration (v1alpha1) [page]deterministic

reference

<p>Package v1alpha1 is the v1alpha1 version of the API.</p>

## Resource Types

[AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration)
[AuthenticationConfiguration](#apiserver-k8s-io-v1alpha1-AuthenticationConfiguration)
[AuthorizationConfiguration](#apiserver-k8s-io-v1alpha1-AuthorizationConfiguration)
[EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration)
[TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration)

## `TracingConfiguration` {#TracingConfiguration}

Appears in:

[KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration)

[TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration)

<p>TracingConfiguration provides versioned configuration for OpenTelemetry tracing clients.</p>

<table class="table"> <thead><tr><th width="30%">Field</th><th>Description</th></tr></thead> <tbody> <tr><td><code>endpoint</code><br/> <code>string</code> </td> <td> <p>Endpoint of the collector this component will report traces to. The connection is insecure, and does not currently support TLS. Recommended is unset, and endpoint is the otlp grpc default, localhost:4317.</p> </td> </tr> <tr><td><code>samplingRatePerMillion</code><br/> <code>int32</code> </td> <td> <p>SamplingRatePerMillion is the number of samples to collect per million spans. Recommended is unset. If unset, sampler respects its parent span's sampling rate, but otherwise never samples.</p> </td> </tr> </tbody> </table>

## `AdmissionConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionConfiguration}

<p>AdmissionConfiguration provides versioned configuration for admission controllers.</p>

## `AuthenticationConfiguration` {#apiserver-k8s-io-v1alpha1-AuthenticationConfiguration}

<p>AuthenticationConfiguration provides versioned configuration for authentication.</p>

<table class="table"> <thead><tr><th width="30%">Field</th><th>Description</th></tr></thead> <tbody> <tr><td><code>apiVersion</code><br/>string</td><td><code>apiserver.k8s.io/v1alpha1</code></td></tr> <tr><td><code>kind</code><br/>string</td><td><code>AuthenticationConfiguration</code></td></tr> <tr><td><code>jwt</code> <B>[Required]</B><br/> <a href="#apiserver-k8s-io-v1alpha1-JWTAuthenticator"><code>[]JWTAuthenticator</code></a> </td> <td> <p>jwt is a list of authenticator to authenticate Kubernetes users using JWT compliant tokens. The authenticator will attempt to parse a raw ID token, verify it's been signed by the configured issuer. The public key to verify the signature is discovered from the issuer's public endpoint using OIDC discovery. For an incoming token, each JWT authenticator will be attempted in the order in which it is specified in this list. Note however that other authenticators may run before or after the JWT authenticators. The specific position of JWT authenticators in relation to other authenticators is neither defined nor stable across releases. Since each JWT authenticator must have a unique issuer URL, at most one JWT authenticator will attempt to cryptographically validate the token.</p> <p>The minimum valid JWT payload must contain the following claims: { "iss": "https://issuer.example.com", "aud": ["audience"], "exp": 1234567890, "": "username" }</p> </td …(trimmed)