Aggregated API client certificates - Certificate types and descriptions | Security and compliance

About
- Welcome
- Learn more about OpenShift Container Platform
- Providing documentation feedback
- About OpenShift Kubernetes Engine
- Legal notice
Release notes
- OpenShift Container Platform 4.18 release notes
- Additional release notes
Getting started
- Kubernetes overview
- OpenShift Container Platform overview
- Web console walkthrough
- Command-line walkthrough
Architecture
- Architecture overview
- Product architecture
- Installation and update
- Red Hat OpenShift Cluster Manager
- About the multicluster engine for Kubernetes Operator
- Control plane architecture
- Understanding OpenShift development
- Red Hat Enterprise Linux CoreOS
- Admission plugins
Disconnected environments
- About disconnected environments
- Converting a connected cluster to a disconnected cluster
- Mirroring in disconnected environments
- Installing a cluster in a disconnected environment
- Using OLM in disconnected environments
- Updating a cluster in a disconnected environment
Installing
- Installation overview
  - Installation overview
  - Selecting an installation method and preparing a cluster
  - Cluster capabilities
  - Support for FIPS cryptography
- Installing on Alibaba Cloud
  - Installing a cluster on Alibaba Cloud using the Assisted Installer
- Installing on AWS
  - Installation methods
  - Configuring an AWS account
  - Installer-provisioned infrastructure
  - User-provisioned infrastructure
  - Installing a three-node cluster
  - Uninstalling a cluster
  - Installation configuration parameters
  - AWS Local Zone or Wavelength Zone tasks
- Installing on Azure
  - Installation methods
  - Configuring an Azure account
  - Installer-provisioned infrastructure
  - User-provisioned infrastructure
  - Installing a three-node cluster
  - Uninstalling a cluster
  - Installation configuration parameters for Azure
- Installing on Azure Stack Hub
  - Installation methods
  - Configuring an Azure Stack Hub account
  - Installer-provisioned infrastructure
  - User-provisioned infrastructure
    - Preparing to install a cluster
    - Installing a cluster using ARM templates
  - Installation configuration parameters
  - Uninstalling a cluster
- Installing on GCP
  - Preparing to install on GCP
  - Configuring a GCP project
  - Installing a cluster quickly on GCP
  - Installing a cluster on GCP with customizations
  - Installing a cluster on GCP with network customizations
  - Installing a cluster on GCP in a disconnected environment
  - Installing a cluster on GCP into an existing VPC
  - Installing a cluster on GCP into a shared VPC
  - Installing a private cluster on GCP
  - Installing a cluster on GCP using Deployment Manager templates
  - Installing a cluster into a shared VPC on GCP using Deployment Manager templates
  - Installing a cluster on GCP in a disconnected environment with user-provisioned infrastructure
  - Installing a three-node cluster on GCP
  - Installation configuration parameters for GCP
  - Uninstalling a cluster on GCP
  - Installing a GCP cluster with the support for configuring multi-architecture compute machines
- Installing on IBM Cloud
  - Preparing to install on IBM Cloud
  - Configuring an IBM Cloud account
  - Configuring IAM for IBM Cloud
  - User-managed encryption
  - Installing a cluster on IBM Cloud with customizations
  - Installing a cluster on IBM Cloud with network customizations
  - Installing a cluster on IBM Cloud into an existing VPC
  - Installing a private cluster on IBM Cloud
  - Installing a cluster on IBM Cloud in a disconnected environment
  - Installation configuration parameters for IBM Cloud
  - Uninstalling a cluster on IBM Cloud
- Installing on Nutanix
  - Preparing to install on Nutanix
  - Fault tolerant deployments
  - Installing a cluster on Nutanix
  - Installing a cluster on Nutanix in a disconnected environment
  - Installing a three-node cluster on Nutanix
  - Uninstalling a cluster on Nutanix
  - Installation configuration parameters for Nutanix
- Installing on-premise with Assisted Installer
  - Installing an on-premise cluster using the Assisted Installer
- Installing an on-premise cluster with the Agent-based Installer
  - Preparing to install with Agent-based Installer
  - Understanding disconnected installation mirroring
  - Installing a cluster with Agent-based Installer
  - Preparing PXE assets for OCP
  - Preparing installation assets for iSCSI booting
  - Preparing an Agent-based installed cluster for the multicluster engine for Kubernetes
  - Installation configuration parameters for the Agent-based Installer
- Installing on a single node
  - Preparing to install OpenShift on a single node
  - Installing OpenShift on a single node
- Installing on bare metal
  - Preparing to install on bare metal
  - User-provisioned infrastructure
  - Installer-provisioned infrastructure
- Installing IBM Cloud Bare Metal (Classic)
  - Prerequisites for IBM Cloud (Classic)
  - Installation workflow for IBM Cloud Bare Metal (Classic)
- Installing on IBM Z and IBM LinuxONE
  - Installation methods
  - User-provisioned infrastructure
  - Installation configuration parameters
  - Configuring additional devices
- Installing on IBM Power
  - Preparing to install on IBM Power
  - Installing a cluster on IBM Power
  - Installing a cluster on IBM Power in a disconnected environment
  - Installation configuration parameters for IBM Power
- Installing on IBM Power Virtual Server
  - Preparing to install on IBM Power Virtual Server
  - Configuring an IBM Cloud account
  - Creating an IBM Power Virtual Server workspace
  - Installing a cluster on IBM Power Virtual Server with customizations
  - Installing a cluster on IBM Power Virtual Server into an existing VPC
  - Installing a private cluster on IBM Power Virtual Server
  - Installing a cluster on IBM Power Virtual Server in a disconnected environment
  - Uninstalling a cluster on IBM Power Virtual Server
  - Installation configuration parameters for IBM Power Virtual Server
- Installing on OpenStack
  - Preparing to install on OpenStack
  - Preparing to install a cluster that uses SR-IOV or OVS-DPDK on OpenStack
  - Installing a cluster on OpenStack with customizations
  - Installing a cluster on OpenStack on your own infrastructure
  - Installing a cluster on OpenStack in a disconnected environment
  - Installing a three-node cluster on OpenStack
  - Configuring network settings after installing OpenStack
  - OpenStack Cloud Controller Manager reference guide
  - Deploying on OpenStack with rootVolume and etcd on local disk
  - Uninstalling a cluster on OpenStack
  - Uninstalling a cluster on OpenStack from your own infrastructure
  - Installation configuration parameters for OpenStack
- Installing on OCI
  - Installing a cluster on Oracle Cloud Infrastructure by using the Assisted Installer
  - Installing a cluster on Oracle Cloud Infrastructure by using the Agent-based Installer
- Installing on VMware vSphere
  - Installation methods
  - Installer-provisioned infrastructure
  - User-provisioned infrastructure
  - Assisted Installer
  - Agent-based Installer
  - Installing a three-node cluster
  - Uninstalling a cluster
  - Using the vSphere Problem Detector Operator
  - Installation configuration parameters
  - Regions and zones for a VMware vCenter
  - Enabling encryption on a vSphere cluster
  - Configuring the vSphere connection settings after an installation
- Installing on any platform
  - Installing a cluster on any platform
- Installation configuration
  - Customizing nodes
  - Configuring your firewall
  - Enabling Linux control group version 1 (cgroup v1)
- Validation and troubleshooting
  - Validating an installation
  - Troubleshooting installation issues
Postinstallation configuration
- Postinstallation configuration overview
- Configuring a private cluster
- Configuring multi-architecture compute machines on an OpenShift cluster
- Cluster tasks
- Node tasks
- Postinstallation network configuration
- Configuring image streams and image registries
- Storage configuration
- Preparing for users
- Changing the cloud provider credentials configuration
- Configuring alert notifications
- Converting a connected cluster to a disconnected cluster
Updating clusters
- Understanding OpenShift updates
- Preparing to update a cluster
- Performing a cluster update
- Troubleshooting a cluster update
  - Gathering data about your cluster update
Support
- Support overview
- Managing your cluster resources
- Getting support
- Remote health monitoring with connected clusters
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
Web console
- Web console overview
- Accessing the web console
- Using the OpenShift Container Platform dashboard to get cluster information
- Adding user preferences
- Configuring the web console
- Customizing the web console
- Dynamic plugins
- Web terminal
- Disabling the web console
- Creating quick start tutorials
- Optional capabilities and products
CLI tools
- CLI tools overview
- OpenShift CLI (oc)
- OpenShift CLI Manager
- Developer CLI (odo)
- Knative CLI (kn) for use with OpenShift Serverless
- Pipelines CLI (tkn)
- GitOps CLI (argocd) for use with OpenShift GitOps
- opm CLI
  - Installing the opm CLI
  - opm CLI reference
- Operator SDK
  - Installing the Operator SDK CLI
  - Operator SDK CLI reference
Security and compliance
- Security and compliance overview
- Container security
- Configuring certificates
- Certificate types and descriptions
- Compliance Operator
- File Integrity Operator
- Security Profiles Operator
- NBDE Tang Server Operator
- cert-manager Operator for Red Hat OpenShift
- Viewing audit logs
- Configuring the audit log policy
- Configuring TLS security profiles
- Configuring seccomp profiles
- Allowing JavaScript-based access to the API server from additional hosts
- Encrypting etcd data
- Scanning pods for vulnerabilities
- Network-Bound Disk Encryption (NBDE)
Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Configuring the internal OAuth server
- Configuring OAuth clients
- Managing user-owned OAuth access tokens
- Understanding identity provider configuration
- Configuring identity providers
- Using RBAC to define and apply permissions
- Removing the kubeadmin user
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Impersonating the system:admin user
- Syncing LDAP groups
- Managing cloud provider credentials
Networking
- Understanding networking
- Zero trust networking
- Accessing hosts
- Networking dashboards
- Networking Operators
  - Kubernetes NMState Operator
  - AWS Load Balancer Operator
  - eBPF manager Operator
  - External DNS Operator
  - MetalLB Operator
  - Cluster Network Operator in OpenShift Container Platform
  - DNS Operator in OpenShift Container Platform
  - Ingress Operator in OpenShift Container Platform
  - Ingress Node Firewall Operator in OpenShift Container Platform
  - SR-IOV Operator
- Network security
  - Understanding network policy APIs
  - Admin network policy
  - Network policy
  - Audit logging for network security
  - Egress Firewall
  - Configuring IPsec encryption
- Configuring the Ingress Controller for manual DNS management
- Verifying connectivity to an endpoint
- Changing the cluster network MTU
- Configuring the node port service range
- Configuring the cluster network IP address range
- Configuring IP failover
- Configuring system controls and interface attributes using the tuning plugin
- Using Stream Control Transmission Protocol
- Using Precision Time Protocol hardware
  - About Precision Time Protocol in OpenShift cluster nodes
  - Configuring PTP devices
  - Developing PTP events consumer applications with the REST API v2
  - PTP events REST API v2 reference
  - Developing PTP events consumer applications with the REST API v1
  - PTP events REST API v1 reference
- CIDR range definitions
- Multiple networks
  - Understanding multiple networks
  - Primary networks
    - UserDefinedNetwork CR
    - NetworkAttachmentDefinition CR
  - Secondary networks
  - About virtual routing and forwarding
  - Assigning a secondary network to a VRF
- Hardware networks
  - About Single Root I/O Virtualization (SR-IOV) hardware networks
  - Configuring an SR-IOV network device
  - Configuring an SR-IOV Ethernet network attachment
  - Configuring an SR-IOV InfiniBand network attachment
  - Configuring an RDMA subsystem for SR-IOV
  - Adding a pod to an SR-IOV network
  - Configuring interface-level network sysctl settings and all-multicast mode for SR-IOV networks
  - Configuring QinQ support for SR-IOV networks
  - Using high performance multicast
  - Using DPDK and RDMA
  - Using pod-level bonding for secondary networks
  - Configuring hardware offloading
  - Switching Bluefield-2 from NIC to DPU mode
- OVN-Kubernetes network plugin
  - About the OVN-Kubernetes network plugin
  - OVN-Kubernetes architecture
  - OVN-Kubernetes troubleshooting
  - OVN-Kubernetes traffic tracing
  - Converting to IPv4/IPv6 dual stack networking
  - Configuring internal subnets
  - Configure an external gateway on the default network
  - Configuring an egress IP address
  - Assigning an egress IP address
  - Configuring an egress service
  - Considerations for the use of an egress router pod
  - Deploying an egress router pod in redirect mode
  - Enabling multicast for a project
  - Disabling multicast for a project
  - Tracking network flows
  - Configuring hybrid networking
- Configuring Routes
  - Route configuration
  - Secured routes
- Configuring ingress cluster traffic
  - Overview
  - Configuring ExternalIPs for services
  - Configuring ingress cluster traffic using an Ingress Controller
  - Configuring the Ingress Controller endpoint publishing strategy
  - Configuring ingress cluster traffic using a load balancer
  - Configuring ingress cluster traffic on AWS
  - Configuring ingress cluster traffic using a service external IP
  - Configuring ingress cluster traffic using a NodePort
  - Configuring ingress cluster traffic using load balancer allowed source ranges
  - Patching existing ingress objects
- Kubernetes NMState
  - Observing and updating node network state and configuration
  - Troubleshooting node network configuration
- Configuring the cluster-wide proxy
- Configuring a custom PKI
- Load balancing on OpenStack
- Load balancing with MetalLB
  - Configuring MetalLB address pools
  - Advertising the IP address pools
  - Configuring MetalLB BGP peers
  - Advertising an IP address pool using the community alias
  - Configuring MetalLB BFD profiles
  - Configuring services to use MetalLB
  - Managing symmetric routing with MetalLB
  - Configuring the integration of MetalLB and FRR-K8s
  - MetalLB logging, troubleshooting, and support
- Associating secondary interfaces metrics to network attachments
Storage
- Storage overview
- Understanding ephemeral storage
- Understanding persistent storage
- Configuring persistent storage
- Using Container Storage Interface (CSI)
- Generic ephemeral volumes
- Expanding persistent volumes
- Dynamic provisioning
Registry
- Registry overview
- Image Registry Operator in OpenShift Container Platform
- Setting up and configuring the registry
- Accessing the registry
- Exposing the registry
Operators
- Operators overview
- Understanding Operators
- User tasks
  - Creating applications from installed Operators
  - Installing Operators in your namespace
- Administrator tasks
- Developing Operators
- Cluster Operators reference
- OLM v1
  - About OLM v1
Extensions
- Extensions overview
- Architecture
- Common terms
- Catalogs
- Cluster extensions
CI/CD
- CI/CD overview
  - About CI/CD
- Builds using Shipwright
  - Overview of Builds
- Builds using BuildConfig
- Pipelines
  - About OpenShift Pipelines
- GitOps
  - About OpenShift GitOps
- Jenkins
Images
- Overview of images
- Configuring the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources
- Using images
Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition by using the Topology view
- Exporting applications
- Working with Helm charts
- Deployments
- Quotas
  - Resource quotas per project
  - Resource quotas across multiple projects
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
- Using the Red Hat Marketplace
Serverless
- About Serverless
  - Serverless overview
Machine configuration
- Machine configuration overview
- Using machine config objects to configure nodes
- Using node disruption policies to minimize disruption from machine config changes
- Configuring MCO-related custom resources
- Updated boot images
- Managing unused rendered machine configs
- Red Hat Enterprise Linux (RHEL) CoreOS image layering
- Machine Config Daemon metrics
Machine management
- Overview of machine management
- Managing compute machines with the Machine API
- Manually scaling a compute machine set
- Modifying a compute machine set
- Machine phases and lifecycle
- Deleting a machine
- Applying autoscaling to a cluster
- Creating infrastructure machine sets
- Adding a RHEL compute machine
- Adding more RHEL compute machines
- Managing user-provisioned infrastructure manually
- Managing control plane machines
- Managing machines with the Cluster API
- Deploying machine health checks
Hosted control planes
- Hosted control planes release notes
- Hosted control planes overview
- Preparing to deploy hosted control planes
- Deploying hosted control planes
- Managing hosted control planes
- Deploying hosted control planes in a disconnected environment
- Updating hosted control planes
- High availability for hosted control planes
- Authentication and authorization for hosted control planes
- Handling machine configuration for hosted control planes
- Using feature gates in a hosted cluster
- Observability for hosted control planes
- Troubleshooting hosted control planes
- Destroying a hosted cluster
- Manually importing a hosted cluster
Nodes
- Overview of nodes
- Working with pods
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- Using jobs and daemon sets
  - Running background tasks on nodes automatically with daemon sets
  - Running tasks in pods using jobs
- Working with nodes
- Working with containers
- Working with clusters
- Remote worker nodes on the network edge
  - Using remote worker node at the network edge
- Worker nodes for single-node OpenShift clusters
  - Adding worker nodes to single-node OpenShift clusters
- Node metrics dashboard
- Manage secure signatures with sigstore
Windows Container Support for OpenShift
- Red Hat OpenShift support for Windows Containers overview
OpenShift sandboxed containers
- Documentation moved
Observability
- Observability overview
  - About Observability
- Cluster Observability Operator
- Monitoring
- Logging
  - Logging 6.0
  - Logging 6.1
- Distributed tracing
- Red Hat build of OpenTelemetry
- Network Observability
- Power Monitoring
Scalability and performance
- Scalability and performance overview
- Recommended performance and scalability practices
  - Recommended control plane practices
  - Recommended infrastructure practices
  - Recommended etcd practices
- Reference design specifications
  - Telco reference design specifications
  - Telco RAN DU reference design specification
  - Telco core reference design specification
- Comparing cluster configurations
  - Understanding the cluster-compare plugin
  - Installing the cluster-compare plugin
  - Using the cluster-compare plugin
  - Creating a reference configuration
  - Performing advanced reference configuration customization
  - Troubleshooting cluster comparisons
- Planning your environment according to object maximums
- Compute Resource Quotas
- Recommended host practices for IBM Z & IBM LinuxONE environments
- Using the Node Tuning Operator
- Using CPU Manager and Topology Manager
- Scheduling NUMA-aware workloads
- Scalability and performance optimization
  - Optimizing storage
  - Optimizing routing
  - Optimizing networking
  - Optimizing CPU usage
- Managing bare metal hosts
- What huge pages do and how they are consumed by apps
- Understanding low latency
- Tuning nodes for low latency with the performance profile
- Provisioning real-time and low latency workloads
- Debugging low latency tuning
- Performing latency tests for platform verification
- Improving cluster stability in high latency environments using worker latency profiles
- Workload partitioning
- Using the Node Observability Operator
Edge computing
- Challenges of the network far edge
- Preparing the hub cluster for ZTP
- Updating GitOps ZTP
- Installing managed clusters with RHACM and SiteConfig resources
- Manually installing a single-node OpenShift cluster with GitOps ZTP
- Recommended single-node OpenShift cluster configuration for vDU application workloads
- Validating cluster tuning for vDU application workloads
- Advanced managed cluster configuration with SiteConfig resources
- Managing cluster policies with PolicyGenerator resources
- Managing cluster policies with PolicyGenTemplate resources
- Using hub templates in PolicyGenerator or PolicyGenTemplate CRs
- Updating managed clusters with the Topology Aware Lifecycle Manager
- Expanding single-node OpenShift clusters with GitOps ZTP
- Pre-caching images for single-node OpenShift deployments
- Image-based upgrade for single-node OpenShift clusters
- Image-based installation for single-node OpenShift
- Day 2 operations for telco core CNF clusters
Specialized hardware and driver enablement
- About specialized hardware and driver enablement
- Driver Toolkit
- Node Feature Discovery Operator
- Kernel Module Management Operator
Hardware accelerators
- About hardware accelerators
- NVIDIA GPU architecture
Backup and restore
- Overview of backup and restore operations
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- Hibernating a cluster
- OADP Application backup and restore
- Control plane backup and restore
Migrating from version 3 to 4
- Migrating from version 3 to 4 overview
- About migrating from OpenShift Container Platform 3 to 4
- Differences between OpenShift Container Platform 3 and 4
- Network considerations
- About MTC
- Installing MTC
- Installing MTC in a disconnected environment
- Upgrading MTC
- Premigration checklists
- Migrating your applications
- Advanced migration options
- Troubleshooting
Migration Toolkit for Containers
- About MTC
- MTC release notes
- Installing MTC
- Installing MTC in a disconnected environment
- Upgrading MTC
- Premigration checklists
- Network considerations
- Direct Migration Requirements
- Migrating your applications
- Advanced migration options
- Troubleshooting
API reference
- API overview
  - Understanding API tiers
  - API compatibility guidelines
  - Editing kubelet log level verbosity and gathering logs
  - API list
- Common object reference
  - Index
- Authorization APIs
  - About Authorization APIs
  - LocalResourceAccessReview [authorization.openshift.io/v1]
  - LocalSubjectAccessReview [authorization.openshift.io/v1]
  - ResourceAccessReview [authorization.openshift.io/v1]
  - SelfSubjectRulesReview [authorization.openshift.io/v1]
  - SubjectAccessReview [authorization.openshift.io/v1]
  - SubjectRulesReview [authorization.openshift.io/v1]
  - SelfSubjectReview [authentication.k8s.io/v1]
  - TokenRequest [authentication.k8s.io/v1]
  - TokenReview [authentication.k8s.io/v1]
  - LocalSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectRulesReview [authorization.k8s.io/v1]
  - SubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
  - About Autoscale APIs
  - ClusterAutoscaler [autoscaling.openshift.io/v1]
  - MachineAutoscaler [autoscaling.openshift.io/v1beta1]
  - HorizontalPodAutoscaler [autoscaling/v2]
  - Scale [autoscaling/v1]
- Cluster APIs
  - About Cluster APIs
  - IPAddress [ipam.cluster.x-k8s.io/v1beta1]
  - IPAddressClaim [ipam.cluster.x-k8s.io/v1beta1]
- Config APIs
  - About Config APIs
  - APIServer [config.openshift.io/v1]
  - Authentication [config.openshift.io/v1]
  - Build [config.openshift.io/v1]
  - ClusterOperator [config.openshift.io/v1]
  - ClusterVersion [config.openshift.io/v1]
  - Console [config.openshift.io/v1]
  - DNS [config.openshift.io/v1]
  - FeatureGate [config.openshift.io/v1]
  - HelmChartRepository [helm.openshift.io/v1beta1]
  - Image [config.openshift.io/v1]
  - ImageDigestMirrorSet [config.openshift.io/v1]
  - ImageContentPolicy [config.openshift.io/v1]
  - ImageTagMirrorSet [config.openshift.io/v1]
  - Infrastructure [config.openshift.io/v1]
  - Ingress [config.openshift.io/v1]
  - Network [config.openshift.io/v1]
  - Node [config.openshift.io/v1]
  - OAuth [config.openshift.io/v1]
  - OperatorHub [config.openshift.io/v1]
  - Project [config.openshift.io/v1]
  - ProjectHelmChartRepository [helm.openshift.io/v1beta1]
  - Proxy [config.openshift.io/v1]
  - Scheduler [config.openshift.io/v1]
- Console APIs
  - About Console APIs
  - ConsoleCLIDownload [console.openshift.io/v1]
  - ConsoleExternalLogLink [console.openshift.io/v1]
  - ConsoleLink [console.openshift.io/v1]
  - ConsoleNotification [console.openshift.io/v1]
  - ConsolePlugin [console.openshift.io/v1]
  - ConsoleQuickStart [console.openshift.io/v1]
  - ConsoleSample [console.openshift.io/v1]
  - ConsoleYAMLSample [console.openshift.io/v1]
- Extension APIs
  - About Extension APIs
  - APIService [apiregistration.k8s.io/v1]
  - CustomResourceDefinition [apiextensions.k8s.io/v1]
  - MutatingWebhookConfiguration [admissionregistration.k8s.io/v1]
  - ValidatingAdmissionPolicy [admissionregistration.k8s.io/v1]
  - ValidatingAdmissionPolicyBinding [admissionregistration.k8s.io/v1]
  - ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1]
- Image APIs
  - About Image APIs
  - Image [image.openshift.io/v1]
  - ImageSignature [image.openshift.io/v1]
  - ImageStreamImage [image.openshift.io/v1]
  - ImageStreamImport [image.openshift.io/v1]
  - ImageStreamLayers [image.openshift.io/v1]
  - ImageStreamMapping [image.openshift.io/v1]
  - ImageStream [image.openshift.io/v1]
  - ImageStreamTag [image.openshift.io/v1]
  - ImageTag [image.openshift.io/v1]
  - SecretList [image.openshift.io/v1]
- Machine APIs
  - About Machine APIs
  - ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
  - ControllerConfig [machineconfiguration.openshift.io/v1]
  - ControlPlaneMachineSet [machine.openshift.io/v1]
  - KubeletConfig [machineconfiguration.openshift.io/v1]
  - MachineConfig [machineconfiguration.openshift.io/v1]
  - MachineConfigPool [machineconfiguration.openshift.io/v1]
  - MachineHealthCheck [machine.openshift.io/v1beta1]
  - Machine [machine.openshift.io/v1beta1]
  - MachineSet [machine.openshift.io/v1beta1]
- Metadata APIs
  - About Metadata APIs
  - APIRequestCount [apiserver.openshift.io/v1]
  - Binding [undefined/v1]
  - ComponentStatus [undefined/v1]
  - ConfigMap [undefined/v1]
  - ControllerRevision [apps/v1]
  - Event [events.k8s.io/v1]
  - Event [undefined/v1]
  - Lease [coordination.k8s.io/v1]
  - Namespace [undefined/v1]
- Monitoring APIs
  - About Monitoring APIs
  - Alertmanager [monitoring.coreos.com/v1]
  - AlertmanagerConfig [monitoring.coreos.com/v1beta1]
  - AlertRelabelConfig [monitoring.openshift.io/v1]
  - AlertingRule [monitoring.openshift.io/v1]
  - PodMonitor [monitoring.coreos.com/v1]
  - Probe [monitoring.coreos.com/v1]
  - Prometheus [monitoring.coreos.com/v1]
  - PrometheusRule [monitoring.coreos.com/v1]
  - ServiceMonitor [monitoring.coreos.com/v1]
  - ThanosRuler [monitoring.coreos.com/v1]
  - NodeMetrics [metrics.k8s.io/v1beta1]
  - PodMetrics [metrics.k8s.io/v1beta1]
- Network APIs
  - About Network APIs
  - AdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - AdminPolicyBasedExternalRoute [k8s.ovn.org/v1]
  - BaselineAdminNetworkPolicy [policy.networking.k8s.io/v1alpha1]
  - CloudPrivateIPConfig [cloud.network.openshift.io/v1]
  - EgressFirewall [k8s.ovn.org/v1]
  - EgressIP [k8s.ovn.org/v1]
  - EgressQoS [k8s.ovn.org/v1]
  - EgressService [k8s.ovn.org/v1]
  - Endpoints [undefined/v1]
  - EndpointSlice [discovery.k8s.io/v1]
  - EgressRouter [network.operator.openshift.io/v1]
  - Ingress [networking.k8s.io/v1]
  - IngressClass [networking.k8s.io/v1]
  - IPPool [whereabouts.cni.cncf.io/v1alpha1]
  - MultiNetworkPolicy [k8s.cni.cncf.io/v1beta1]
  - NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
  - NetworkPolicy [networking.k8s.io/v1]
  - OverlappingRangeIPReservation [whereabouts.cni.cncf.io/v1alpha1]
  - PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
  - Route [route.openshift.io/v1]
  - Service [undefined/v1]
- Node APIs
  - About Node APIs
  - Node [undefined/v1]
  - PerformanceProfile [performance.openshift.io/v2]
  - Profile [tuned.openshift.io/v1]
  - RuntimeClass [node.k8s.io/v1]
  - Tuned [tuned.openshift.io/v1]
- OAuth APIs
  - About OAuth APIs
  - OAuthAccessToken [oauth.openshift.io/v1]
  - OAuthAuthorizeToken [oauth.openshift.io/v1]
  - OAuthClientAuthorization [oauth.openshift.io/v1]
  - OAuthClient [oauth.openshift.io/v1]
  - UserOAuthAccessToken [oauth.openshift.io/v1]
- Operator APIs
  - About Operator APIs
  - Authentication [operator.openshift.io/v1]
  - CloudCredential [operator.openshift.io/v1]
  - ClusterCSIDriver [operator.openshift.io/v1]
  - Console [operator.openshift.io/v1]
  - Config [operator.openshift.io/v1]
  - Config [imageregistry.operator.openshift.io/v1]
  - Config [samples.operator.openshift.io/v1]
  - CSISnapshotController [operator.openshift.io/v1]
  - DNS [operator.openshift.io/v1]
  - DNSRecord [ingress.operator.openshift.io/v1]
  - Etcd [operator.openshift.io/v1]
  - ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
  - ImagePruner [imageregistry.operator.openshift.io/v1]
  - IngressController [operator.openshift.io/v1]
  - InsightsOperator [operator.openshift.io/v1]
  - KubeAPIServer [operator.openshift.io/v1]
  - KubeControllerManager [operator.openshift.io/v1]
  - KubeScheduler [operator.openshift.io/v1]
  - KubeStorageVersionMigrator [operator.openshift.io/v1]
  - MachineConfiguration [operator.openshift.io/v1]
  - Network [operator.openshift.io/v1]
  - OpenShiftAPIServer [operator.openshift.io/v1]
  - OpenShiftControllerManager [operator.openshift.io/v1]
  - OperatorPKI [network.operator.openshift.io/v1]
  - ServiceCA [operator.openshift.io/v1]
  - Storage [operator.openshift.io/v1]
- OperatorHub APIs
  - About OperatorHub APIs
  - CatalogSource [operators.coreos.com/v1alpha1]
  - ClusterServiceVersion [operators.coreos.com/v1alpha1]
  - InstallPlan [operators.coreos.com/v1alpha1]
  - OLMConfig [operators.coreos.com/v1]
  - Operator [operators.coreos.com/v1]
  - OperatorCondition [operators.coreos.com/v2]
  - OperatorGroup [operators.coreos.com/v1]
  - PackageManifest [packages.operators.coreos.com/v1]
  - Subscription [operators.coreos.com/v1alpha1]
- Policy APIs
  - About Policy APIs
  - Eviction [policy/v1]
  - PodDisruptionBudget [policy/v1]
- Project APIs
  - About Project APIs
  - Project [project.openshift.io/v1]
  - ProjectRequest [project.openshift.io/v1]
- Provisioning APIs
  - About Provisioning APIs
  - BMCEventSubscription [metal3.io/v1alpha1]
  - BareMetalHost [metal3.io/v1alpha1]
  - DataImage [metal3.io/v1alpha1]
  - FirmwareSchema [metal3.io/v1alpha1]
  - HardwareData [metal3.io/v1alpha1]
  - HostFirmwareComponents [metal3.io/v1alpha1]
  - HostFirmwareSettings [metal3.io/v1alpha1]
  - Metal3Remediation [infrastructure.cluster.x-k8s.io/v1beta1]
  - Metal3RemediationTemplate [infrastructure.cluster.x-k8s.io/v1beta1]
  - PreprovisioningImage [metal3.io/v1alpha1]
  - Provisioning [metal3.io/v1alpha1]
- RBAC APIs
  - About RBAC APIs
  - ClusterRoleBinding [rbac.authorization.k8s.io/v1]
  - ClusterRole [rbac.authorization.k8s.io/v1]
  - RoleBinding [rbac.authorization.k8s.io/v1]
  - Role [rbac.authorization.k8s.io/v1]
- Role APIs
  - About Role APIs
  - ClusterRoleBinding [authorization.openshift.io/v1]
  - ClusterRole [authorization.openshift.io/v1]
  - RoleBindingRestriction [authorization.openshift.io/v1]
  - RoleBinding [authorization.openshift.io/v1]
  - Role [authorization.openshift.io/v1]
- Schedule and quota APIs
  - About Schedule and quota APIs
  - AppliedClusterResourceQuota [quota.openshift.io/v1]
  - ClusterResourceQuota [quota.openshift.io/v1]
  - FlowSchema [flowcontrol.apiserver.k8s.io/v1]
  - LimitRange [undefined/v1]
  - PriorityClass [scheduling.k8s.io/v1]
  - PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1]
  - ResourceQuota [undefined/v1]
- Security APIs
  - About Security APIs
  - CertificateSigningRequest [certificates.k8s.io/v1]
  - CredentialsRequest [cloudcredential.openshift.io/v1]
  - PodSecurityPolicyReview [security.openshift.io/v1]
  - PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
  - PodSecurityPolicySubjectReview [security.openshift.io/v1]
  - RangeAllocation [security.openshift.io/v1]
  - Secret [undefined/v1]
  - SecurityContextConstraints [security.openshift.io/v1]
  - ServiceAccount [undefined/v1]
- Storage APIs
  - About Storage APIs
  - CSIDriver [storage.k8s.io/v1]
  - CSINode [storage.k8s.io/v1]
  - CSIStorageCapacity [storage.k8s.io/v1]
  - PersistentVolume [undefined/v1]
  - PersistentVolumeClaim [undefined/v1]
  - StorageClass [storage.k8s.io/v1]
  - StorageState [migration.k8s.io/v1alpha1]
  - StorageVersionMigration [migration.k8s.io/v1alpha1]
  - VolumeAttachment [storage.k8s.io/v1]
  - VolumeSnapshot [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
- Template APIs
  - About Template APIs
  - BrokerTemplateInstance [template.openshift.io/v1]
  - PodTemplate [undefined/v1]
  - Template [template.openshift.io/v1]
  - TemplateInstance [template.openshift.io/v1]
- User and group APIs
  - About User and group APIs
  - Group [user.openshift.io/v1]
  - Identity [user.openshift.io/v1]
  - UserIdentityMapping [user.openshift.io/v1]
  - User [user.openshift.io/v1]
- Workloads APIs
  - About Workloads APIs
  - BuildConfig [build.openshift.io/v1]
  - Build [build.openshift.io/v1]
  - BuildLog [build.openshift.io/v1]
  - BuildRequest [build.openshift.io/v1]
  - CronJob [batch/v1]
  - DaemonSet [apps/v1]
  - Deployment [apps/v1]
  - DeploymentConfig [apps.openshift.io/v1]
  - DeploymentConfigRollback [apps.openshift.io/v1]
  - DeploymentLog [apps.openshift.io/v1]
  - DeploymentRequest [apps.openshift.io/v1]
  - Job [batch/v1]
  - Pod [undefined/v1]
  - ReplicationController [undefined/v1]
  - ReplicaSet [apps/v1]
  - StatefulSet [apps/v1]
Lightspeed
- About Lightspeed
  - OpenShift Lightspeed overview
Service Mesh
- Service Mesh 3.x
  - OpenShift Service Mesh 3.0 TP1 overview
- Service Mesh 2.x
- Service Mesh 1.x
Virtualization
- About
- Release notes
  - OpenShift Virtualization release notes
- Getting started
  - Getting started with OpenShift Virtualization
  - virtctl and libguestfs
- Installing
- Postinstallation configuration
- Updating
  - Updating OpenShift Virtualization
- Creating a virtual machine
  - Creating VMs from instance types
  - Creating VMs from templates
- Advanced VM creation
- Managing VMs
- Networking
- Storage
- Live migration
- Nodes
- Monitoring
- Support
- Backup and restore

Purpose
Management
Expiration
Customization

Purpose

Aggregated API client certificates are used to authenticate the KubeAPIServer when connecting to the Aggregated API Servers.

Management

These certificates are managed by the system and not the user.

Expiration

This CA is valid for 30 days.

The managed client certificates are valid for 30 days.

CA and client certificates are rotated automatically through the use of controllers.

Customization

You cannot customize the aggregated API server certificates.