Package google.cloud.gkehub.identityservice.v1alpha

Index

MembershipSpec

Anthos Identity Service: Configuration for a single Membership.

Fields
auth_methods[]

MembershipSpec.AuthMethod

A member may support multiple auth methods.

AuthMethod

Configuration of an auth method for a member/cluster. Only one authentication method (e.g., OIDC and LDAP) can be set per AuthMethod.

Fields
name

string

Identifier for auth config.

proxy

string

Proxy server address to use for auth method.

Union field auth_config. supported auth configurations. auth_config can be only one of the following:
oidc_config

MembershipSpec.AuthMethod.OidcConfig

OIDC specific configuration.

azuread_config

MembershipSpec.AuthMethod.AzureADConfig

AzureAD specific Configuration.

google_config

MembershipSpec.AuthMethod.GoogleConfig

GoogleConfig specific configuration.

AzureADConfig

Configuration for the AzureAD Auth flow.

Fields
client_id

string

ID for the registered client application that makes authentication requests to the Azure AD identity provider.

tenant

string

Kind of Azure AD account to be authenticated. Supported values are or for accounts belonging to a specific tenant.

kubectl_redirect_uri

string

The redirect URL that kubectl uses for authorization.

client_secret

string

Input only. Unencrypted AzureAD client secret will be passed to the GKE Hub CLH.

encrypted_client_secret

bytes

Output only. Encrypted AzureAD client secret.

GoogleConfig

Configuration for the Google Plugin Auth flow.

Fields
disable

bool

Disable automatic configuration of Google Plugin on supported platforms.

OidcConfig

Configuration for OIDC Auth flow.

Fields
client_id

string

ID for OIDC client application.

certificate_authority_data

string

PEM-encoded CA for OIDC provider.

issuer_uri

string

URI for the OIDC provider. This should point to the level below .well-known/openid-configuration.

kubectl_redirect_uri

string

Registered redirect uri to redirect users going through OAuth flow using kubectl plugin.

scopes

string

Comma-separated list of identifiers.

extra_params

string

Comma-separated list of key-value pairs.

user_claim

string

Claim in OIDC ID token that holds username.

user_prefix

string

Prefix to prepend to user name.

groups_claim

string

Claim in OIDC ID token that holds group information.

group_prefix

string

Prefix to prepend to group name.

deploy_cloud_console_proxy

bool

Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console.

client_secret

string

Input only. Unencrypted OIDC client secret will be passed to the GKE Hub CLH.

encrypted_client_secret

bytes

Output only. Encrypted OIDC Client secret

enable_access_token

bool

Enable access token.

MembershipState

Anthos Identity Service: State for a single Membership.

Fields
installed_version

string

Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK.

state

MembershipState.DeploymentState

Deployment state on this member

failure_reason

string

The reason of the failure.

member_config

MembershipSpec

Last reconciled membership configuration

DeploymentState

Deployment state enum

Enums
DEPLOYMENT_STATE_UNSPECIFIED Unspecified state
OK deployment succeeds
ERROR Failure with error.