mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
102 lines
4.3 KiB
Plaintext
102 lines
4.3 KiB
Plaintext
// Module included in the following assemblies:
|
||
//
|
||
// * authentication/index.adoc
|
||
|
||
:_mod-docs-content-type: REFERENCE
|
||
[id="openshift-auth-common-terms_{context}"]
|
||
= Glossary of common terms for {product-title} authentication and authorization
|
||
|
||
This glossary defines common terms that are used in {product-title} authentication and authorization.
|
||
|
||
authentication::
|
||
An authentication determines access to an {product-title} cluster and ensures only authenticated users access the {product-title} cluster.
|
||
|
||
authorization::
|
||
Authorization determines whether the identified user has permissions to perform the requested action.
|
||
|
||
bearer token::
|
||
Bearer token is used to authenticate to API with the header `Authorization: Bearer <token>`.
|
||
|
||
// In OSD and ROSA, the CCO is managed by Red Hat SRE.
|
||
ifndef::openshift-dedicated,openshift-rosa[]
|
||
Cloud Credential Operator::
|
||
The Cloud Credential Operator (CCO) manages cloud provider credentials as custom resource definitions (CRDs).
|
||
endif::openshift-dedicated,openshift-rosa[]
|
||
|
||
config map::
|
||
A config map provides a way to inject configuration data into the pods. You can reference the data stored in a config map in a volume of type `ConfigMap`. Applications running in a pod can use this data.
|
||
|
||
containers::
|
||
Lightweight and executable images that consist of software and all its dependencies. Because containers virtualize the operating system, you can run containers in a data center, public or private cloud, or your local host.
|
||
|
||
Custom Resource (CR)::
|
||
A CR is an extension of the Kubernetes API.
|
||
|
||
group::
|
||
A group is a set of users. A group is useful for granting permissions to multiple users one time.
|
||
|
||
HTPasswd::
|
||
HTPasswd updates the files that store usernames and password for authentication of HTTP users.
|
||
|
||
Keystone::
|
||
Keystone is an {rh-openstack-first} project that provides identity, token, catalog, and policy services.
|
||
|
||
Lightweight directory access protocol (LDAP)::
|
||
LDAP is a protocol that queries user information.
|
||
|
||
ifndef::openshift-dedicated,openshift-rosa[]
|
||
manual mode::
|
||
In manual mode, a user manages cloud credentials instead of the Cloud Credential Operator (CCO).
|
||
endif::openshift-dedicated,openshift-rosa[]
|
||
|
||
ifndef::openshift-dedicated,openshift-rosa,openshift-rosa-hcp[]
|
||
mint mode::
|
||
In mint mode, the Cloud Credential Operator (CCO) uses the provided administrator-level cloud credential to create new credentials for components in the cluster with only the specific permissions that are required.
|
||
+
|
||
[NOTE]
|
||
====
|
||
Mint mode is the default and the preferred setting for the CCO to use on the platforms for which it is supported.
|
||
====
|
||
endif::openshift-dedicated,openshift-rosa,openshift-rosa-hcp[]
|
||
|
||
namespace::
|
||
A namespace isolates specific system resources that are visible to all processes. Inside a namespace, only processes that are members of that namespace can see those resources.
|
||
|
||
node::
|
||
A node is a worker machine in the {product-title} cluster. A node is either a virtual machine (VM) or a physical machine.
|
||
|
||
OAuth client::
|
||
OAuth client is used to get a bearer token.
|
||
|
||
OAuth server::
|
||
The {product-title} control plane includes a built-in OAuth server that determines the user’s identity from the configured identity provider and creates an access token.
|
||
|
||
OpenID Connect::
|
||
The OpenID Connect is a protocol to authenticate the users to use single sign-on (SSO) to access sites that use OpenID Providers.
|
||
|
||
ifndef::openshift-dedicated,openshift-rosa[]
|
||
passthrough mode::
|
||
In passthrough mode, the Cloud Credential Operator (CCO) passes the provided cloud credential to the components that request cloud credentials.
|
||
endif::openshift-dedicated,openshift-rosa[]
|
||
|
||
pod::
|
||
A pod is the smallest logical unit in Kubernetes. A pod is comprised of one or more containers to run in a worker node.
|
||
|
||
regular users::
|
||
Users that are created automatically in the cluster upon first login or via the API.
|
||
|
||
request header::
|
||
A request header is an HTTP header that is used to provide information about HTTP request context, so that the server can track the response of the request.
|
||
|
||
role-based access control (RBAC)::
|
||
A key security control to ensure that cluster users and workloads have access to only the resources required to execute their roles.
|
||
|
||
service accounts::
|
||
Service accounts are used by the cluster components or applications.
|
||
|
||
system users::
|
||
Users that are created automatically when the cluster is installed.
|
||
|
||
users::
|
||
Users is an entity that can make requests to API.
|