TeleportProvisionToken

Report an Issue

Is this page helpful?

How can we improve this page?

View as Markdown

This guide lists the fields in the TeleportProvisionToken resource, which you can apply after installing the Teleport Kubernetes operator.

resources.teleport.dev/v2

apiVersion: resources.teleport.dev/v2

Field	Type	Description
apiVersion	string	APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind	string	Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata	object
spec	object	ProvisionToken resource definition v2 from Teleport

spec

Field	Type	Description
allow	[]object	Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.
aws_iid_ttl	string	AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity Documents used to join the cluster with this token.
azure	object	Azure allows the configuration of options specific to the "azure" join method.
azure_devops	object	AzureDevops allows the configuration of options specific to the "azure_devops" join method.
bitbucket	object	Bitbucket allows the configuration of options specific to the "bitbucket" join method.
bot_name	string	BotName is the name of the bot this token grants access to, if any
bound_keypair	object	BoundKeypair allows the configuration of options specific to the "bound_keypair" join method.
circleci	object	CircleCI allows the configuration of options specific to the "circleci" join method.
env0	object	Env0 allows the configuration of options specific to the "env0" join method.
gcp	object	GCP allows the configuration of options specific to the "gcp" join method.
generic_oidc	object	GenericOIDC allows the configuration of generic OIDC join tokens.
github	object	GitHub allows the configuration of options specific to the "github" join method.
gitlab	object	GitLab allows the configuration of options specific to the "gitlab" join method.
integration	string	Integration name which provides credentials for validating join attempts. Currently only in use for validating the AWS Organization ID in the IAM Join method.
join_method	string	JoinMethod is the joining method required in order to use this token. Supported joining methods include: azure, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm
kubernetes	object	Kubernetes allows the configuration of options specific to the "kubernetes" join method.
oracle	object	Oracle allows the configuration of options specific to the "oracle" join method.
roles	[]string	Roles is a list of roles associated with the token, that will be converted to metadata in the SSH and X509 certificates issued to the user of the token
spacelift	object	Spacelift allows the configuration of options specific to the "spacelift" join method.
suggested_agent_matcher_labels	object	SuggestedAgentMatcherLabels is a set of labels to be used by agents to match on resources. When an agent uses this token, the agent should monitor resources that match those labels. For databases, this means adding the labels to db_service.resources.labels. Currently, only node-join scripts create a configuration according to the suggestion.
suggested_labels	object	SuggestedLabels is a set of labels that resources should set when using this token to enroll themselves in the cluster. Currently, only node-join scripts create a configuration according to the suggestion.
terraform_cloud	object	TerraformCloud allows the configuration of options specific to the "terraform_cloud" join method.
tpm	object	TPM allows the configuration of options specific to the "tpm" join method.

spec.allow items

Field	Type	Description
aws_account	string	AWSAccount is the AWS account ID.
aws_arn	string	AWSARN is used for the IAM join method, the AWS identity of joining nodes must match this ARN. Supports wildcards "*" and "?".
aws_organization_id	string	AWSOrganizationID is used for the IAM join method, the AWS identity of joining nodes must belong to this organization.
aws_organizational_units	object	AWSOrganizationalUnits contains rules for matching AWS accounts based on their Organizational Units. Requires AWS Organization ID to be specified. The account's root ID is considered an Organizational Unit when validating the rule.
aws_regions	[]string	AWSRegions is used for the EC2 join method and is a list of AWS regions a node is allowed to join from.
aws_role	string	AWSRole is used for the EC2 join method and is the ARN of the AWS role that the Auth Service will assume in order to call the ec2 API.

spec.allow items.aws_organizational_units

Field	Type	Description
exclude	[]string	Exclude is a list of AWS Organizational Unit IDs and children OUs to exclude. Accounts that belong to these OUs, and their children, will be excluded, even if they were included. Only exact matches are supported. Optional. If empty, no OUs are excluded.
include	[]string	Include is a list of AWS Organizational Unit IDs and children OUs to include. Accounts that belong to these OUs, and their children, will be included. Only exact matches or wildcard (*) are supported. Required.

spec.azure

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

spec.azure.allow items

Field	Type	Description
resource_groups	[]string	ResourceGroups is a list of Azure resource groups the node is allowed to join from.
subscription	string	Subscription is the Azure subscription.
tenant	string	Tenant is the Azure Tenant ID.

spec.azure_devops

Field	Type	Description
allow	[]object	Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token. At least one allow rule must be specified.
organization_id	string	OrganizationID specifies the UUID of the Azure DevOps organization that this join token will grant access to. This is used to identify the correct issuer verification of the ID token. This is a required field.

spec.azure_devops.allow items

Field	Type	Description
definition_id	string	The ID of the AZDO pipeline definition. Example: 1 Mapped from the def_id claim.
pipeline_name	string	The name of the AZDO pipeline. Example: my-pipeline. Mapped out of the sub claim.
project_id	string	The ID of the AZDO pipeline. Example: 271ef6f7-0000-0000-0000-4b54d9129990 Mapped from the prj_id claim.
project_name	string	The name of the AZDO project. Example: my-project. Mapped out of the sub claim.
repository_ref	string	The reference of the repository the pipeline is using. Example: refs/heads/main. Mapped from the rpo_ref claim.
repository_uri	string	The URI of the repository the pipeline is using. Example: https://github.com/gravitational/teleport.git. Mapped from the rpo_uri claim.
repository_version	string	The individual commit of the repository the pipeline is using. Example: e6b9eb29a288b27a3a82cc19c48b9d94b80aff36. Mapped from the rpo_ver claim.
sub	string	Sub also known as Subject is a string that roughly uniquely identifies the workload. Example: p://my-organization/my-project/my-pipeline Mapped from the sub claim.

spec.bitbucket

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.
audience	string	Audience is a Bitbucket-specified audience value for this token. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.
identity_provider_url	string	IdentityProviderURL is a Bitbucket-specified issuer URL for incoming OIDC tokens. It is unique to each Bitbucket repository, and must be set to the value as written in the Pipelines -> OpenID Connect section of the repository settings.

spec.bitbucket.allow items

Field	Type	Description
branch_name	string	BranchName is the name of the branch on which this pipeline executed.
deployment_environment_uuid	string	DeploymentEnvironmentUUID is the UUID of the deployment environment targeted by this pipelines run, if any. These values may be found in the "Pipelines -> OpenID Connect -> Deployment environments" section of the repository settings.
repository_uuid	string	RepositoryUUID is the UUID of the repository for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. {...}. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.
workspace_uuid	string	WorkspaceUUID is the UUID of the workspace for which this token was issued. Bitbucket UUIDs must begin and end with braces, e.g. {...}. This value may be found in the Pipelines -> OpenID Connect section of the repository settings.

spec.bound_keypair

Field	Type	Description
onboarding	object	Onboarding contains parameters related to initial onboarding and keypair registration.
recovery	object	Recovery contains parameters related to recovery after identity expiration.
rotate_after	string	RotateAfter is an optional timestamp that forces clients to perform a keypair rotation on the next join or recovery attempt after the given date. If LastRotatedAt is unset or before this timestamp, a rotation will be requested. It is recommended to set this value to the current timestamp if a rotation should be triggered on the next join attempt.

spec.bound_keypair.onboarding

Field	Type	Description
initial_public_key	string	InitialPublicKey is used to preregister a public key generated by tbot keypair create. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, initial_join_secret and must_register_before are ignored. This value is written in SSH authorized_keys format.
must_register_before	string	MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if initial_public_key is set.
registration_secret	string	RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with initial_public_key. If initial_public_key is set, this value is ignored. Otherwise, if set, this value will be used to populate .status.bound_keypair.registration_secret. If unset and no initial_public_key is provided, a random secure value will be generated server-side to populate the status field.

spec.bound_keypair.recovery

Field	Type	Description
limit	integer	Limit is the maximum number of allowed recovery attempts. This value may be raised or lowered after creation to allow additional recovery attempts should the initial limit be exhausted. If mode is set to standard, recovery attempts will only be allowed if .status.bound_keypair.recovery_count is less than this limit. This limit is not enforced if mode is set to relaxed or insecure. This value must be at least 1 to allow for the initial join during onboarding, which counts as a recovery.
mode	string	Mode sets the recovery rule enforcement mode. It may be one of these values: - standard (or unset): all configured rules enforced. The recovery limit and client join state are required and verified. This is the most secure recovery mode. - relaxed: recovery limit is not enforced, but client join state is still required. This effectively allows unlimited recovery attempts, but client join state still helps mitigate stolen credentials. - insecure: neither the recovery limit nor client join state are enforced. This allows any client with the private key to join freely. This is less secure, but can be useful in certain situations, like in otherwise unsupported CI/CD providers. This mode should be used with care, and RBAC rules should be configured to heavily restrict which resources this identity can access.

spec.circleci

Field	Type	Description
allow	[]object	Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.
organization_id	string

spec.circleci.allow items

Field	Type	Description
context_id	string
project_id	string

spec.env0

Field	Type	Description
allow	[]object	Allow is a list of Rules, jobs using this token must match at least one allow rule to use this token.

spec.env0.allow items

Field	Type	Description
deployer_email	string	DeployerEmail is the email of the person that triggered the deployment, corresponding to deployerEmail in an Env0 OIDC token.
deployment_type	string	DeploymentType is the env0 deployment type, such as "deploy", "destroy", etc. Corresponds to deploymentType in an Env0 OIDC token.
env0_tag	string	Env0Tag is a custom tag value corresponding to env0Tag when ENV0_OIDC_TAG is set.
environment_id	string	EnvironmentID is the unique identifier of the Env0 environment, corresponding to environmentId in an Env0 OIDC token.
environment_name	string	EnvironmentName is the name of the Env0 environment, corresponding to environmentName in an Env0 OIDC token.
organization_id	string	OrganizationID is the unique organization identifier, corresponding to organizationId in an Env0 OIDC token.
project_id	string	ProjectID is a unique project identifier, corresponding to projectId in an Env0 OIDC token.
project_name	string	ProjectName is the name of the project under which the job was run corresponding to projectName in an Env0 OIDC token.
template_id	string	TemplateID is the unique identifier of the Env0 template, corresponding to templateId in an Env0 OIDC token.
template_name	string	TemplateName is the name of the Env0 template, corresponding to templateName in an Env0 OIDC token.
workspace_name	string	WorkspaceName is the name of the Env0 workspace, corresponding to workspaceName in an Env0 OIDC token.

spec.gcp

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

spec.gcp.allow items

Field	Type	Description
locations	[]string	Locations is a list of regions (e.g. "us-west1") and/or zones (e.g. "us-west1-b").
project_ids	[]string	ProjectIDs is a list of project IDs (e.g. <example-id-123456>).
service_accounts	[]string	ServiceAccounts is a list of service account emails (e.g. <project-number>[email protected]).

spec.generic_oidc

Field	Type	Description
allow_any	[]object	AllowAny evaluates complex rules using "OR" semantics. If any rules are specified, at least one rule must evaluate to true for the join attempt to be allowed. These rules are evaluated after must_match_fields, if any field matchers are specified in that block. Note that at least one rule, either in must_match_fields or allow_any, must be specified for any join attempts to succeed.
audience	string	Audience is the expected audience value (required). This must match or be included in the list of aud values in the JWT provided by the client when joining. For providers that do not allow you to configure this value yourself (this is technically an OIDC spec violation, but is common), use the value they provide. Otherwise, we recommend using a value that uniquely identifies the Teleport cluster and join token. For example, you can use this scheme: $clusterName/$tokenName For a cluster named example.teleport.sh and a token named example, this would result in an audience of example.teleport.sh/example. If you prefer, you can also use a UUID instead of the token name. Note that you will need to configure the matching value with the issuer, usually at request time.
insecure_allow_http_issuer	boolean	InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.
issuer	string	Issuer contains the expected iss value as written in the JWT you wish to trust. Unless static_jwks is configured, this issuer must be accessible over HTTPS to the Teleport cluster and must serve valid OIDC metadata, including discovery configuration and JWKS keys.
must_match_fields	object	MustMatchFields perform simple comparison matches using "AND" semantics. Rules are specified by mirroring the structure of the JWT, using values that are expected to be equal to those on the incoming token. These field matching rules can only be used to compare simple values: strings, numbers, booleans, and nested fields. Complex values, including lists, will need to use allow_any expression rules instead. If any field match rules are specified, all must be equal to corresponding JWT fields for the join attempt to succeed. If complex rules are specified in allow_any, those are evaluated after must_match_fields. If must_match_fields is not specified or is empty, only rules in allow_any are evaluated. These rules can be used as "global" rules that apply to all join attempts. For example, you can use these to ensure all attempts originate from your organization, then use allow_any rules to allow individual repositories, pipelines, or workspaces. Note that at least one rule, either in must_match_fields or allow_any, must be specified for any join attempts to succeed.
static_jwks	string	StaticJWKS is an optional static JWKS value that can be used to specify JWKS keys when either OIDC discovery is either not supported by the provider or the discovery configuration is not accessible to Teleport. When set, configuration and JWKS keys will not be fetched from the URL contained in issuer and JWTs will be validated using the key set specified here.
tls_ca	string	TLSCA is a TLS CA certificate that should be used to verify requests for OIDC metadata from the issuer instead of Teleport's CA store, useful if the issuer is not public or otherwise uses a self-signed certificate. Note that this value only applies to requests using this token, and will be used instead of and not in addition to the system CA store, and will need to be updated manually if the remote CA is updated.

spec.generic_oidc.allow_any items

Field	Type	Description
conditions	[]object	Conditions are simple eq/not_eq/in/not_in conditions that check individual fields. All conditions must be satisfied for a join attempt to be allowed. Mutually exclusive with expression.
expression	string	Expression is a predicate expression that must evaluate to true for the join attempt to be allowed. Expressions are provided the claims object, containing all claims extracted from the incoming JWT. It is mutually exclusive with conditions.

spec.generic_oidc.allow_any items.conditions items

Field	Type	Description
attribute	string	The name of the field this condition should check, separated by "." for nested fields.
eq	object	An "equals" operator. Only one operator may be set within a condition.
in	object	An "in" operator. Only one operator may be set within a condition.
not_eq	object	A "not equals" operator. Only one operator may be set within a condition.
not_in	object	A "not in" operator. Only one operator may be set within a condition.

spec.generic_oidc.allow_any items.conditions items.eq

Field	Type	Description
value	string	The value to compare the attribute against.

spec.generic_oidc.allow_any items.conditions items.in

Field	Type	Description
values	[]string	The list of values to compare the attribute against.

spec.generic_oidc.allow_any items.conditions items.not_eq

Field	Type	Description
value	string	The value to compare the attribute against.

spec.generic_oidc.allow_any items.conditions items.not_in

Field	Type	Description
values	[]string	The list of values to compare the attribute against.

spec.github

Field	Type	Description
allow	[]object	Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.
enterprise_server_host	string	EnterpriseServerHost allows joining from runners associated with a GitHub Enterprise Server instance. When unconfigured, tokens will be validated against github.com, but when configured to the host of a GHES instance, then the tokens will be validated against host. This value should be the hostname of the GHES instance, and should not include the scheme or a path. The instance must be accessible over HTTPS at this hostname and the certificate must be trusted by the Auth Service.
enterprise_slug	string	EnterpriseSlug allows the slug of a GitHub Enterprise organisation to be included in the expected issuer of the OIDC tokens. This is for compatibility with the include_enterprise_slug option in GHE. This field should be set to the slug of your enterprise if this is enabled. If this is not enabled, then this field must be left empty. This field cannot be specified if enterprise_server_host is specified. See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise for more information about customized issuer values.
static_jwks	string	StaticJWKS disables fetching of the GHES signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitHub Actions in GHES instances that are not reachable by the Teleport Auth Service.

spec.github.allow items

Field	Type	Description
actor	string	The personal account that initiated the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
enterprise	string	The name of the enterprise in which the repository is stored.
enterprise_id	string	The ID of the enterprise in which the repository is stored.
environment	string	The name of the environment used by the job. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
ref	string	The git ref that triggered the workflow run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
ref_type	string	The type of ref, for example: "branch".
repository	string	The repository from where the workflow is running. This includes the name of the owner e.g gravitational/teleport This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
repository_owner	string	The name of the organization in which the repository is stored. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
sub	string	Sub also known as Subject is a string that roughly uniquely identifies the workload. The format of this varies depending on the type of github action run. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
workflow	string	The name of the workflow. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

spec.gitlab

Field	Type	Description
allow	[]object	Allow is a list of TokenRules, nodes using this token must match one allow rule to use this token.
domain	string	Domain is the domain of your GitLab instance. This will default to gitlab.com - but can be set to the domain of your self-hosted GitLab e.g gitlab.example.com.
static_jwks	string	StaticJWKS disables fetching of the GitLab signing keys via the JWKS/OIDC endpoints, and allows them to be directly specified. This allows joining from GitLab CI instances that are not reachable by the Teleport Auth Service.

spec.gitlab.allow items

Field	Type	Description
ci_config_ref_uri	string	CIConfigRefURI is the ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main.
ci_config_sha	string	CIConfigSHA is the git commit SHA for the ci_config_ref_uri.
deployment_tier	string	DeploymentTier is the deployment tier of the environment the job specifies
environment	string	Environment limits access by the environment the job deploys to (if one is associated)
environment_protected	boolean	EnvironmentProtected is true if the Git ref is protected, false otherwise.
namespace_path	string	NamespacePath is used to limit access to jobs in a group or user's projects. Example: mygroup This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
pipeline_source	string	PipelineSource limits access by the job pipeline source type. https://docs.gitlab.com/ee/ci/jobs/job_control.html#common-if-clauses-for-rules Example: web
project_path	string	ProjectPath is used to limit access to jobs belonging to an individual project. Example: mygroup/myproject This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
project_visibility	string	ProjectVisibility is the visibility of the project where the pipeline is running. Can be internal, private, or public.
ref	string	Ref allows access to be limited to jobs triggered by a specific git ref. Ensure this is used in combination with ref_type. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
ref_protected	boolean	RefProtected is true if the Git ref is protected, false otherwise.
ref_type	string	RefType allows access to be limited to jobs triggered by a specific git ref type. Example: branch or tag
sub	string	Sub roughly uniquely identifies the workload. Example: project_path:mygroup/my-project:ref_type:branch:ref:main project_path:GROUP/PROJECT:ref_type:TYPE:ref:BRANCH_NAME This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
user_email	string	UserEmail is the email of the user executing the job
user_id	string	UserID is the ID of the user executing the job
user_login	string	UserLogin is the username of the user executing the job

spec.kubernetes

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.
oidc	object	OIDCConfig configures the oidc type.
static_jwks	object	StaticJWKS is the configuration specific to the static_jwks type.
type	string	Type controls which behavior should be used for validating the Kubernetes Service Account token. Support values: - in_cluster - static_jwks - oidc If unset, this defaults to in_cluster.

spec.kubernetes.allow items

Field	Type	Description
service_account	string	ServiceAccount is the namespaced name of the Kubernetes service account. Its format is "namespace:service-account".
service_account_name	string	ServiceAccountName is the name of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.
service_account_namespace	string	ServiceAccountNamespace is the namespace of the Kubernetes service account. This field supports "glob-style" matching: - Use '*' to match zero or more characters. - Use '?' to match any single character.

spec.kubernetes.oidc

Field	Type	Description
insecure_allow_http_issuer	boolean	InsecureAllowHTTPIssuer is a flag that, if set, disables the requirement that the issuer must use HTTPS.
issuer	string	Issuer is the URI of the OIDC issuer. It must have an accessible and OIDC-compliant /.well-known/oidc-configuration endpoint. This should be a valid URL and must exactly match the issuer field in a service account JWT. For example: https://oidc.eks.us-west-2.amazonaws.com/id/12345...

spec.kubernetes.static_jwks

Field	Type	Description
jwks	string	JWKS should be the JSON Web Key Set formatted public keys of that the Kubernetes Cluster uses to sign service account tokens. This can be fetched from /openid/v1/jwks on the Kubernetes API Server.

spec.oracle

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.

spec.oracle.allow items

Field	Type	Description
instances	[]string	Instances is a list of the OCIDs of specific instances that are allowed to join. If empty, any instance matching the other fields in the rule is allowed. Limited to 100 instance OCIDs per rule.
parent_compartments	[]string	ParentCompartments is a list of the OCIDs of compartments an instance is allowed to join from. Only direct parents are allowed, i.e. no nested compartments. If empty, any compartment is allowed.
regions	[]string	Regions is a list of regions an instance is allowed to join from. Both full region names ("us-phoenix-1") and abbreviations ("phx") are allowed. If empty, any region is allowed.
tenancy	string	Tenancy is the OCID of the instance's tenancy. Required.

spec.spacelift

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.
enable_glob_matching	boolean	EnableGlobMatching enables glob-style matching for the space_id and caller_id fields in the rules.
hostname	string	Hostname is the hostname of the Spacelift tenant that tokens will originate from. E.g example.app.spacelift.io

spec.spacelift.allow items

Field	Type	Description
caller_id	string	CallerID is the ID of the caller, ie. the stack or module that generated the run. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.
caller_type	string	CallerType is the type of the caller, ie. the entity that owns the run - either stack or module.
scope	string	Scope is the scope of the token - either read or write. See https://docs.spacelift.io/integrations/cloud-providers/oidc/#about-scopes
space_id	string	SpaceID is the ID of the space in which the run that owns the token was executed. This field supports "glob-style" matching when enable_glob_matching is true: - Use '*' to match zero or more characters. - Use '?' to match any single character.

spec.suggested_agent_matcher_labels

Field	Type	Description
key	string
value	string

spec.suggested_labels

Field	Type	Description
key	string
value	string

spec.terraform_cloud

Field	Type	Description
allow	[]object	Allow is a list of Rules, nodes using this token must match one allow rule to use this token.
audience	string	Audience is the JWT audience as configured in the TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform Cloud. If unset, defaults to the Teleport cluster name. For example, if TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo is set in Terraform Cloud, this value should be foo. If the variable is set to match the cluster name, it does not need to be set here.
hostname	string	Hostname is the hostname of the Terraform Enterprise instance expected to issue JWTs allowed by this token. This may be unset for regular Terraform Cloud use, in which case it will be assumed to be app.terraform.io. Otherwise, it must both match the iss (issuer) field included in JWTs, and provide standard JWKS endpoints.

spec.terraform_cloud.allow items

Field	Type	Description
organization_id	string	OrganizationID is the ID of the HCP Terraform organization. At least one organization value is required, either ID or name.
organization_name	string	OrganizationName is the human-readable name of the HCP Terraform organization. At least one organization value is required, either ID or name.
project_id	string	ProjectID is the ID of the HCP Terraform project. At least one project or workspace value is required, either ID or name.
project_name	string	ProjectName is the human-readable name for the HCP Terraform project. At least one project or workspace value is required, either ID or name.
run_phase	string	RunPhase is the phase of the run the token was issued for, e.g. plan or apply
workspace_id	string	WorkspaceID is the ID of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.
workspace_name	string	WorkspaceName is the human-readable name of the HCP Terraform workspace. At least one project or workspace value is required, either ID or name.

spec.tpm

Field	Type	Description
allow	[]object	Allow is a list of Rules, the presented delegated identity must match one allow rule to permit joining.
ekcert_allowed_cas	[]string	EKCertAllowedCAs is a list of CA certificates that will be used to validate TPM EKCerts. When specified, joining TPMs must present an EKCert signed by one of the specified CAs. TPMs that do not present an EKCert will be not permitted to join. When unspecified, TPMs will be allowed to join with either an EKCert or an EKPubHash.

spec.tpm.allow items

Field	Type	Description
description	string	Description is a human-readable description of the rule. It has no bearing on whether or not a TPM is allowed to join, but can be used to associate a rule with a specific host (e.g the asset tag of the server in which the TPM resides). Example: "build-server-100"
ek_certificate_serial	string	EKCertificateSerial is the serial number of the EKCert in hexadecimal with colon separated nibbles. This value will not be checked when a TPM does not have an EKCert configured. Example: 73:df:dc:bd:af:ef:8a:d8:15:2e:96:71:7a:3e:7f:a4
ek_public_hash	string	EKPublicHash is the SHA256 hash of the EKPub marshaled in PKIX format and encoded in hexadecimal. This value will also be checked when a TPM has submitted an EKCert, and the public key in the EKCert will be used for this check. Example: d4b45864d9d6fabfc568d74f26c35ababde2105337d7af9a6605e1c56c891aa6