<command>/<version> (<platform>/<architecture>) <client>/<git_commit>
Azure Red Hat OpenShift implements a user agent that can be used to prevent an application developer’s CLI accessing the Azure Red Hat OpenShift API. If a client uses a particular library or binary file, they cannot access the Azure Red Hat OpenShift API.
You construct user agents for the Azure Red Hat OpenShift CLI from a set of values within Azure Red Hat OpenShift:
<command>/<version> (<platform>/<architecture>) <client>/<git_commit>
For example, when:
<command> = oc
<version> = The client version. For example, v4.3.0
. Requests made against the Kubernetes
API at /api
receive the Kubernetes version, while requests made against the
Azure Red Hat OpenShift API at /oapi
receive the Azure Red Hat OpenShift version (as specified
by oc version
)
<platform> = linux
<architecture> = amd64
<client> = openshift
, or kubernetes
depending on if the request is made against the Kubernetes API at /api
, or the Azure Red Hat OpenShift API at /oapi
<git_commit> = The Git commit of the client version (for example, f034127
)
the user agent is:
oc/v3.3.0 (linux/amd64) openshift/f034127
As an administrator, you can prevent clients from accessing the
API with the userAgentMatching
configuration setting of a master
configuration.
Modify the master configuration file to include the user agent configuration.
For example, the following user agent denies the Kubernetes 1.2 client binary,
OKD 1.1.3 binary, and the POST and PUT httpVerbs
:
policyConfig:
userAgentMatchingConfig:
defaultRejectionMessage: "Your client is too old. Go to https://example.org to update it."
deniedClients:
- regex: '\w+/v(?:(?:1\.1\.1)|(?:1\.0\.1)) \(.+/.+\) openshift/\w{7}'
- regex: '\w+/v(?:1\.1\.3) \(.+/.+\) openshift/\w{7}'
httpVerbs:
- POST
- PUT
- regex: '\w+/v1\.2\.0 \(.+/.+\) kubernetes/\w{7}'
httpVerbs:
- POST
- PUT
requiredClients: null
The following example denies clients that do not exactly match an expected client:
policyConfig:
userAgentMatchingConfig:
defaultRejectionMessage: "Your client is too old. Go to https://example.org to update it."
deniedClients: []
requiredClients:
- regex: '\w+/v1\.1\.3 \(.+/.+\) openshift/\w{7}'
- regex: '\w+/v1\.2\.0 \(.+/.+\) kubernetes/\w{7}'
httpVerbs:
- POST
- PUT