16.3. 声明性配置示例

name: A sample auth provider
minimumRole: Analyst
uiEndpoint: central.custom-domain.com:443
extraUIEndpoints:
    - central-alt.custom-domain.com:443
groups:
    - key: email
      value: example@example.com
      role: Admin
    - key: groups
      value: reviewers
      role: Analyst
requiredAttributes:
    - key: org_id
      value: "12345"
claimMappings:
    - path: org_id
      value: my_org_id
oidc:
    issuer: sample.issuer.com
    mode: auto
    clientID: CLIENT_ID
    clientSecret: CLIENT_SECRET
clientSecret: CLIENT_SECRET
iap:
    audience: audience
saml:
    spIssuer: sample.issuer.com
    metadataURL: sample.provider.com/metadata
saml:
    spIssuer: sample.issuer.com
    cert: |
    ssoURL: saml.provider.com
    idpIssuer: idp.issuer.com
userpki:
    certificateAuthorities: |
    certificate
openshift:
    enable: true

issuer: https://token.actions.githubusercontent.com
type: GITHUB_ACTION
tokenExpirationDuration: 20m
mappings:
  - key: sub
    value: repos:stackrox:stackrox
    role: Analyst

name: A sample permission set
description: A sample permission set created declaratively
resources:
- resource: Integration
  access: READ_ACCESS
- resource: Administration
  access: READ_WRITE_ACCESS

name: A sample access scope
description: A sample access scope created declaratively
rules:
    included:
        - cluster: secured-cluster-A
          namespaces:
            - namespaceA
        - cluster: secured-cluster-B
    clusterLabelSelectors:
        - requirements:
        - requirements:
          - key: kubernetes.io/metadata.name
            operator: IN
            values:
            - production
            - staging
            - environment

name: A sample role
description: A sample role created declaratively
permissionSet: A sample permission set
accessScope: Unrestricted