> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> KubeAuthenticationConfig configures kube-apiserver authentication.

# KubeAuthenticationConfig

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthenticationConfig
# Kubernetes API server [authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) configuration.
configuration:
    anonymous:
        conditions:
            - path: /livez
            - path: /readyz
            - path: /healthz
        enabled: true
    jwt: []
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`configuration`</td>
      <td>Unstructured</td>
      <td>Kubernetes API server [authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) configuration.<br />The value is the literal Kubernetes authentication configuration.<br /><br />This document replaces the legacy kube-apiserver authentication flags, which are rejected in<br />`KubeAPIServerConfig` `extraArgs`: kube-apiserver refuses any `--oidc-*` flag whenever<br />`--authentication-config` is set, and Talos always sets it.<br /><br />Flag equivalents:<br />`--anonymous-auth` -> `anonymous.enabled`,<br />`--oidc-issuer-url` -> `jwt[].issuer.url`,<br />`--oidc-client-id` -> `jwt[].issuer.audiences`,<br />`--oidc-ca-file` -> `jwt[].issuer.certificateAuthority`,<br />`--oidc-username-claim` -> `jwt[].claimMappings.username.claim`,<br />`--oidc-username-prefix` -> `jwt[].claimMappings.username.prefix`,<br />`--oidc-groups-claim` -> `jwt[].claimMappings.groups.claim`,<br />`--oidc-groups-prefix` -> `jwt[].claimMappings.groups.prefix`,<br />`--oidc-required-claim` -> `jwt[].claimValidationRules[]`.<br /><br />`--oidc-signing-algs` has no equivalent and cannot be configured: with structured authentication<br />configuration kube-apiserver accepts every RFC 7518 asymmetric algorithm<br />(RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512).</td>

      <td />
    </tr>
  </tbody>
</table>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.