支持控制台（Console）开发人员开始试用联系人

18.3. Declarative configuration examples

You can create declarative configurations by using the following examples as a guide. Use the roxctl declarative-config lint command to verify that your configurations are valid.

Declarative configuration authentication provider example

name: A sample auth provider
minimumRole: Analyst
1 

uiEndpoint: central.custom-domain.com:443
2 

extraUIEndpoints:
3 

    - central-alt.custom-domain.com:443
groups:
4 

    - key: email
5 

      value: example@example.com
      role: Admin
6 

    - key: groups
      value: reviewers
      role: Analyst
requiredAttributes:
7 

    - key: org_id
      value: "12345"
claimMappings:
8 

    - path: org_id
      value: my_org_id
oidc:
9 

    issuer: sample.issuer.com
10 

    mode: auto
11 

    clientID: CLIENT_ID
    clientSecret: CLIENT_SECRET
clientSecret: CLIENT_SECRET
iap:
12 

    audience: audience
saml:
13 

    spIssuer: sample.issuer.com
    metadataURL: sample.provider.com/metadata
saml:
14 

    spIssuer: sample.issuer.com
    cert: |
15 

    ssoURL: saml.provider.com
    idpIssuer: idp.issuer.com
userpki:
    certificateAuthorities: |
16 

    certificate
17 

openshift:
18 

    enable: true

1
Identifies the minimum role that will be assigned by default to any user logging in. If left blank, the value is None.
2
Use the user interface endpoint of your Central instance.
3
If your Central instance is exposed to different endpoints, specify them here.
4
These fields map users to specific roles, based on their attributes.
5
The key can be any claim returned from the authentication provider.
6
Identifies the role that the users are given. You can use a default role or a declaratively-created role.
7
Optional: Use these fields if attributes returned from the authentication provider are required; for example, if the audience is limited to a specific organization or group.
8
Optional: Use these fields if claims returned from the identity provider should be mapped to custom claims.
9
This section is required only for OpenID Connect (OIDC) authentication providers.
10
Identifies the expected issuer for the token.
11
Identifies the OIDC callback mode. Possible values are auto, post, query, and fragment. The preferred value is auto.
12
This section is required only for Google Identity-Aware Proxy (IAP) authentication providers.
13
This section is required only for Security Assertion Markup Language (SAML) 2.0 dynamic configuration authentication providers.
14
This section is required only for SAML 2.0 static configuration authentication providers.
15
Include the certificate in Privacy Enhanced Mail (PEM) format.
16
This section is required only for authentication with user certificates.
17
Include the certificate in PEM format.
18
This section is required only for OpenShift Auth authentication providers.

18.3.2. Declarative configuration permission set example
复制链接

Declarative configuration permission set example

name: A sample permission set
description: A sample permission set created declaratively
resources:
- resource: Integration
1 

  access: READ_ACCESS
2 

- resource: Administration
  access: READ_WRITE_ACCESS

1
For a full list of supported resources, go to Access Control Permission Sets.
2
Access can be either READ_ACCESS or READ_WRITE_ACCESS.

18.3.3. Declarative configuration access scope example
复制链接

Declarative configuration access scope example

name: A sample access scope
description: A sample access scope created declaratively
rules:
    included:
        - cluster: secured-cluster-A
1 

          namespaces:
            - namespaceA
        - cluster: secured-cluster-B
2 

    clusterLabelSelectors:
        - requirements:
        - requirements:
          - key: kubernetes.io/metadata.name
            operator: IN
3 

            values:
            - production
            - staging
            - environment

1
Identifies a cluster where only specific namespaces are included within the access scope.
2
Identifies a cluster where all namespaces are included within the access scope.
3
Identifies the Operator to use for the label selection. Valid values are IN, NOT_IN, EXISTS, and NOT_EXISTS.

18.3.4. Declarative configuration role example
复制链接

Declarative configuration role example

name: A sample role
description: A sample role created declaratively
permissionSet: A sample permission set
1 

accessScope: Unrestricted
2

1
Name of the permission set; can be either one of the system permission sets or a declaratively-created permission set.
2
Name of the access scope; can be either one of the system access scopes or a declaratively-created access scope.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部