> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KubeAuthenticationWebhookConfig

> KubeAuthenticationWebhookConfig configures kube-apiserver webhook token authentication.
Bearer tokens which are not recognized by other authenticators are sent to the webhook
(a `TokenReview` request) to be authenticated, e.g. for
[aws-iam-authenticator](https://github.com/kubernetes-sigs/aws-iam-authenticator).

Talos writes the kubeconfig to a file inside the kube-apiserver static pod and sets the
`--authentication-token-webhook-*` flags of kube-apiserver accordingly,
so these flags are not allowed in `KubeAPIServerConfig` `extraArgs`.

See [webhook token authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication).


```yaml theme={null}
apiVersion: v1alpha1
kind: KubeAuthenticationWebhookConfig
kubeconfig: | # Kubeconfig kube-apiserver uses to connect to the authentication webhook.
    apiVersion: v1
    kind: Config
    clusters:
      - name: aws-iam-authenticator
        cluster:
          server: https://127.0.0.1:21362/authenticate
          certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCi4uLgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    users:
      - name: apiserver
    contexts:
      - name: webhook
        context:
          cluster: aws-iam-authenticator
          user: apiserver
    current-context: webhook
version: v1beta1 # The API version of the `authentication.k8s.io` `TokenReview` to send to and expect from the webhook.
cacheTTL: 5m0s # The duration to cache responses from the webhook token authenticator.
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`kubeconfig`</td>
      <td>string</td>
      <td>Kubeconfig kube-apiserver uses to connect to the authentication webhook.\
      \
      The kubeconfig should be self-contained: kube-apiserver can't access any files on the host,\
      so certificates and keys should be specified inline (`certificate-authority-data`, `client-certificate-data`,\
      `client-key-data`), and `tokenFile`, `exec` and `auth-provider` are not supported.\
      If the certificate authority is not specified, kube-apiserver uses the trusted root CAs of the machine.</td>

      <td />
    </tr>

    <tr>
      <td>`version`</td>
      <td>string</td>
      <td>The API version of the `authentication.k8s.io` `TokenReview` to send to and expect from the webhook.\
      \
      Defaults to the kube-apiserver default (`v1beta1`).</td>
      <td>`v1`\
      `v1beta1`\
      </td>
    </tr>

    <tr>
      <td>`cacheTTL`</td>
      <td>Duration</td>
      <td>The duration to cache responses from the webhook token authenticator.\
      \
      Defaults to the kube-apiserver default (2 minutes), set to `0s` to disable caching.</td>

      <td />
    </tr>
  </tbody>
</table>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.