6323db59ba
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
30 lines
1.6 KiB
YAML
30 lines
1.6 KiB
YAML
# Owner-review candidate only. Not a kubectl resource and not activated.
|
|
# Cluster owner must merge with existing authenticators, validate natively and
|
|
# preserve existing admin/service-account authentication and rollback access.
|
|
apiVersion: apiserver.config.k8s.io/v1
|
|
kind: AuthenticationConfiguration
|
|
jwt:
|
|
- issuer:
|
|
url: https://kc.coulomb.social
|
|
audiences:
|
|
- playwright-kubernetes
|
|
audienceMatchPolicy: MatchAny
|
|
claimValidationRules:
|
|
- expression: "claims.aud == 'playwright-kubernetes' || claims.aud == ['playwright-kubernetes']"
|
|
message: dedicated Playwright audience required
|
|
- expression: "has(claims.scope) && 'playwright:connect' in claims.scope.split(' ')"
|
|
message: Playwright access scope required
|
|
- expression: "claims.principal_type == 'human' || (claims.principal_type == 'service' && has(claims.roles) && 'coding-agent' in claims.roles)"
|
|
message: identified human or registered coding agent required
|
|
- expression: "claims.sub != '' && claims.exp > claims.iat && claims.exp - claims.iat <= 3600"
|
|
message: nonempty subject and bounded token lifetime required
|
|
claimMappings:
|
|
username:
|
|
expression: "'keycape:' + claims.principal_type + ':' + claims.sub"
|
|
groups:
|
|
expression: "['playwright-consumers']"
|
|
userValidationRules:
|
|
- expression: "!user.username.startsWith('system:')"
|
|
message: reserved Kubernetes identity prefix refused
|
|
- expression: "user.groups == ['playwright-consumers']"
|
|
message: only the Playwright consumer group may be mapped
|