Skip to main content
FieldTypeDescriptionValue(s)
configurationUnstructuredKubernetes API server authentication configuration.
The value is the literal Kubernetes authentication configuration.

This document replaces the legacy kube-apiserver authentication flags, which are rejected in
KubeAPIServerConfig extraArgs: kube-apiserver refuses any --oidc-* flag whenever
--authentication-config is set, and Talos always sets it.

Flag equivalents:
--anonymous-auth -> anonymous.enabled,
--oidc-issuer-url -> jwt[].issuer.url,
--oidc-client-id -> jwt[].issuer.audiences,
--oidc-ca-file -> jwt[].issuer.certificateAuthority,
--oidc-username-claim -> jwt[].claimMappings.username.claim,
--oidc-username-prefix -> jwt[].claimMappings.username.prefix,
--oidc-groups-claim -> jwt[].claimMappings.groups.claim,
--oidc-groups-prefix -> jwt[].claimMappings.groups.prefix,
--oidc-required-claim -> jwt[].claimValidationRules[].

--oidc-signing-algs has no equivalent and cannot be configured: with structured authentication
configuration kube-apiserver accepts every RFC 7518 asymmetric algorithm
(RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512).