open_id_connects

Creates, updates, deletes, gets or lists an open_id_connects resource.

Overview

Name	`open_id_connects`
Type	Resource
Id	`ovh.cloud_kube.open_id_connects`

Fields

The following fields are returned by SELECT queries:

successful operation

Name	Datatype	Description
`client_id`	`string`	Client ID (wire: clientId)
`ca_content`	`string`	Content of the certificate for the CA, in base64 format, that signed your identity provider's web certificate. Defaults to the host's root CAs. (wire: caContent)
`groups_claim`	`array`	JWT claim to use as the user's group. If the claim is present it must be an array of strings. (wire: groupsClaim)
`groups_prefix`	`string`	Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra. (wire: groupsPrefix)
`issuer_url`	`string`	Issuer URL (wire: issuerUrl)
`required_claim`	`array`	key=value pairs that describe required claims in the ID Token. If set, the claims are verified to be present in the ID Token with a matching value. (wire: requiredClaim)
`signing_algorithms`	`array`	The signing algorithms accepted. Default is "RS256". (wire: signingAlgorithms)
`username_claim`	`string`	JWT claim to use as the user name. By default sub, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as email or name, depending on their provider. However, claims other than email will be prefixed with the issuer URL to prevent naming clashes with other plugins. (wire: usernameClaim)
`username_prefix`	`string`	Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this field isn't set and oidcUsernameClaim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of oidcIssuerUrl. The value - can be used to disable all prefixing. (wire: usernamePrefix)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Description
`get`	`select`	`kube_id`, `service_name`	Get openIdConnect integration parameters
`create`	`insert`	`kube_id`, `service_name`, `client_id`, `issuer_url`	Configure APIServer for OpenIdConnect
`update`	`update`	`kube_id`, `service_name`	Update parameters and reconfigure APIServer
`delete`	`delete`	`kube_id`, `service_name`	Remove OpenIdConnect integration from APIServer

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`api_host`	`string`	The OVHcloud API host. Selected by OVH_ENDPOINT (ovh-eu, ovh-ca or ovh-us; default ovh-eu). (default: api.eu.ovhcloud.com, x-stackQL-envVarSelector: {"envVar":"OVH_ENDPOINT","default":"ovh-eu","values":{"ovh-eu":"api.eu.ovhcloud.com","ovh-ca":"api.ca.ovhcloud.com","ovh-us":"api.us.ovhcloud.com"}})
`kube_id`	`string`	Kube ID (wire: kubeId)
`service_name`	`string`	The Public Cloud project ID. Resolved from OVH_CLOUD_PROJECT_SERVICE when set.

`SELECT` examples

Get openIdConnect integration parameters

SELECT
client_id,
ca_content,
groups_claim,
groups_prefix,
issuer_url,
required_claim,
signing_algorithms,
username_claim,
username_prefix
FROM ovh.cloud_kube.open_id_connects
WHERE kube_id = '{{ kube_id }}' -- required
AND service_name = '{{ service_name }}' -- required unless OVH_CLOUD_PROJECT_SERVICE is set
;

`INSERT` examples

create
Manifest

Configure APIServer for OpenIdConnect

INSERT INTO ovh.cloud_kube.open_id_connects (
ca_content,
client_id,
groups_claim,
groups_prefix,
issuer_url,
required_claim,
signing_algorithms,
username_claim,
username_prefix,
kube_id,
service_name
)
SELECT 
'{{ ca_content }}',
'{{ client_id }}' /* required */,
'{{ groups_claim }}',
'{{ groups_prefix }}',
'{{ issuer_url }}' /* required */,
'{{ required_claim }}',
'{{ signing_algorithms }}',
'{{ username_claim }}',
'{{ username_prefix }}',
'{{ kube_id }}',
'{{ service_name }}'
RETURNING
client_id,
ca_content,
groups_claim,
groups_prefix,
issuer_url,
required_claim,
signing_algorithms,
username_claim,
username_prefix
;

# Description fields are for documentation purposes
- name: open_id_connects
props:
  - name: kube_id
    value: "{{ kube_id }}"
    description: Required parameter for the open_id_connects resource.
  - name: service_name
    value: "{{ service_name }}"
    description: Required parameter for the open_id_connects resource.
  - name: ca_content
    value: "{{ ca_content }}"
    description: |
      Content of the certificate for the CA, in base64 format, that signed your identity provider's web certificate. Defaults to the host's root CAs.
  - name: client_id
    value: "{{ client_id }}"
    description: |
      Client ID
  - name: groups_claim
    value:
      - "{{ groups_claim }}"
    description: |
      JWT claim to use as the user's group. If the claim is present it must be an array of strings.
  - name: groups_prefix
    value: "{{ groups_prefix }}"
    description: |
      Prefix prepended to group claims to prevent clashes with existing names (such as system: groups). For example, the value oidc: will create group names like oidc:engineering and oidc:infra.
  - name: issuer_url
    value: "{{ issuer_url }}"
    description: |
      Issuer URL
  - name: required_claim
    value:
      - "{{ required_claim }}"
    description: |
      key=value pairs that describe required claims in the ID Token. If set, the claims are verified to be present in the ID Token with a matching value.
  - name: signing_algorithms
    value:
      - "{{ signing_algorithms }}"
    description: |
      The signing algorithms accepted. Default is "RS256".
  - name: username_claim
    value: "{{ username_claim }}"
    description: |
      JWT claim to use as the user name. By default sub, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as email or name, depending on their provider. However, claims other than email will be prefixed with the issuer URL to prevent naming clashes with other plugins.
  - name: username_prefix
    value: "{{ username_prefix }}"
    description: |
      Prefix prepended to username claims to prevent clashes with existing names (such as system: users). For example, the value oidc: will create usernames like oidc:jane.doe. If this field isn't set and oidcUsernameClaim is a value other than email the prefix defaults to ( Issuer URL )# where ( Issuer URL ) is the value of oidcIssuerUrl. The value - can be used to disable all prefixing.

`UPDATE` examples

update

Update parameters and reconfigure APIServer

UPDATE ovh.cloud_kube.open_id_connects
SET 
ca_content = '{{ ca_content }}',
client_id = '{{ client_id }}',
groups_claim = '{{ groups_claim }}',
groups_prefix = '{{ groups_prefix }}',
issuer_url = '{{ issuer_url }}',
required_claim = '{{ required_claim }}',
signing_algorithms = '{{ signing_algorithms }}',
username_claim = '{{ username_claim }}',
username_prefix = '{{ username_prefix }}'
WHERE 
kube_id = '{{ kube_id }}' --required
AND service_name = '{{ service_name }}' --required unless OVH_CLOUD_PROJECT_SERVICE is set;

`DELETE` examples

delete

Remove OpenIdConnect integration from APIServer

DELETE FROM ovh.cloud_kube.open_id_connects
WHERE kube_id = '{{ kube_id }}' --required
AND service_name = '{{ service_name }}' --required unless OVH_CLOUD_PROJECT_SERVICE is set
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​