---
title: Security APIs
---

# Security APIs {#security-apis}

## CertificateSigningRequest \[certificates.k8s.io/v1\] {#_certificatesigningrequest_certificatesk8siov1}

Description
:   CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.

    Kubelets use this API to obtain:

    1. client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client-kubelet" signerName).
    2. serving certificates for TLS endpoints kube-apiserver can connect to securely (with the "kubernetes.io/kubelet-serving" signerName).

    This API can be used to request client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client" signerName), or to obtain certificates from custom non-Kubernetes signers.

Type
:   ```
    `object`
    ```

## CredentialsRequest \[cloudcredential.openshift.io/v1\] {#_credentialsrequest_cloudcredentialopenshiftiov1}

Description
:   CredentialsRequest is the Schema for the credentialsrequests API

Type
:   ```
    `object`
    ```

## PodSecurityPolicyReview \[security.openshift.io/v1\] {#_podsecuritypolicyreview_securityopenshiftiov1}

Description
:   PodSecurityPolicyReview checks which service accounts (not users, since that would be cluster-wide) can create the `PodTemplateSpec` in question.

    Compatibility level 2: Stable within a major release for a minimum of 9 months or 3 minor releases (whichever is longer).

Type
:   ```
    `object`
    ```

## PodSecurityPolicySelfSubjectReview \[security.openshift.io/v1\] {#_podsecuritypolicyselfsubjectreview_securityopenshiftiov1}

Description
:   PodSecurityPolicySelfSubjectReview checks whether this user/SA tuple can create the PodTemplateSpec

    Compatibility level 2: Stable within a major release for a minimum of 9 months or 3 minor releases (whichever is longer).

Type
:   ```
    `object`
    ```

## PodSecurityPolicySubjectReview \[security.openshift.io/v1\] {#_podsecuritypolicysubjectreview_securityopenshiftiov1}

Description
:   PodSecurityPolicySubjectReview checks whether a particular user/SA tuple can create the PodTemplateSpec.

    Compatibility level 2: Stable within a major release for a minimum of 9 months or 3 minor releases (whichever is longer).

Type
:   ```
    `object`
    ```

## RangeAllocation \[security.openshift.io/v1\] {#_rangeallocation_securityopenshiftiov1}

Description
:   RangeAllocation is used so we can easily expose a RangeAllocation typed for security group

    Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.

Type
:   ```
    `object`
    ```

## Secret \[v1\] {#_secret_v1}

Description
:   Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.

Type
:   ```
    `object`
    ```

## SecurityContextConstraints \[security.openshift.io/v1\] {#_securitycontextconstraints_securityopenshiftiov1}

Description
:   SecurityContextConstraints governs the ability to make requests that affect the SecurityContext that will be applied to a container. For historical reasons SCC was exposed under the core Kubernetes API group. That exposure is deprecated and will be removed in a future release - users should instead use the security.openshift.io group to manage SecurityContextConstraints.

    Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).

Type
:   ```
    `object`
    ```

## ServiceAccount \[v1\] {#_serviceaccount_v1}

Description
:   ServiceAccount binds together: \* a name, understood by users, and perhaps by peripheral systems, for an identity \* a principal that can be authenticated and authorized \* a set of secrets

Type
:   ```
    `object`
    ```