<p>EncryptionConfiguration stores the complete configuration for encryption providers.

It also allows the use of wildcards to specify the resources that should be encrypted.

resources, even custom resources that are added after API server start.

Use of wildcards that overlap within the same resource list or across multiple

entries are not allowed since part of the configuration would be ineffective.

<td>

<p>resources is a list of kubernetes resources which have to be encrypted. The resource names are derived from <code>resource</code> or <code>resource.group</code> of the group/version/resource.

eg: pandas.awesome.bears.example is a custom resource with 'group': awesome.bears.example, 'resource': pandas.

eg: '*.' will encrypt all resources in the core group (such as pods, configmaps, etc).</p>

</td>

</tr>

</tr>

</tbody>

</table>

Same as the --oidc-username-claim and --oidc-username-prefix flags.

If username.expression is set, the expression must produce a string value.

If username.expression uses 'claims.email', then 'claims.email_verified' must be used in

An example claim validation rule expression that matches the validation automatically

applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing

the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified

</tr>

</tbody>

</table>

Same as the --oidc-username-claim and --oidc-username-prefix flags.

If username.expression is set, the expression must produce a string value.

If username.expression uses 'claims.email', then 'claims.email_verified' must be used in

An example claim validation rule expression that matches the validation automatically

applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing

the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified

</tr>

</tbody>

</table>

and URL path.</p>

<p>Each entry in matchImages is a pattern which can optionally contain a port and a path.

Globs can be used in the domain, but not in the port or the path. Globs are supported

Matching partial subdomains like 'app</em>.k8s.io' is also supported. Each glob can only match

a single subdomain segment, so *.io does not match *.k8s.io.</p>

<p>A match exists between an image and a matchImage when all of the below are true:</p>

<p>Example values of matchImages:</p>

<ul>

<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>

<li>gcr.io</li>

<li>registry.io:8080/path</li>

</ul>

</td>

</tr>

</tbody>

</table>

<p>preloadedImagesVerificationAllowlist specifies a list of images that are

exempted from credential reverification for the &quot;NeverVerifyAllowlistedImages&quot;

<code>imagePullCredentialsVerificationPolicy</code>.

Only use image specs without an image tag or digest.</p>

</td>

</tr>

and URL path.</p>

<p>Each entry in matchImages is a pattern which can optionally contain a port and a path.

Globs can be used in the domain, but not in the port or the path. Globs are supported

<p>A match exists between an image and a matchImage when all of the below are true:</p>

<ul>

<li>Both contain the same number of domain parts and each part matches.</li>

<p>Example values of matchImages:</p>

<ul>

<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>

<li>gcr.io</li>

<li>registry.io:8080/path</li>

</ul>

</td>

</tr>

</tbody>

</table>

this field to null if no valid credentials can be returned for the requested image.</p>

<p>Each key in the map is a pattern which can optionally contain a port and a path.

Globs can be used in the domain, but not in the port or the path. Globs are supported

a single subdomain segment, so *.io does not match *.k8s.io.</p>

<p>The kubelet will match images against the key when all of the below are true:</p>

<ul>

<p>Example keys:</p>

<ul>

<li>123456789.dkr.ecr.us-east-1.amazonaws.com</li>

<li>gcr.io</li>

<li>registry.io:8080/path</li>

</ul>

</td>