---
api_metadata:
  apiVersion: "authentication.k8s.io/v1"
  import: "k8s.io/api/authentication/v1"
  kind: "TokenReview"
content_type: "api_reference"
description: "TokenReview 尝试通过验证令牌来确认已知用户。"
title: "TokenReview"
weight: 3
auto_generated: true
---

<!--
api_metadata:
  apiVersion: "authentication.k8s.io/v1"
  import: "k8s.io/api/authentication/v1"
  kind: "TokenReview"
content_type: "api_reference"
description: "TokenReview attempts to authenticate a token to a known user."
title: "TokenReview"
weight: 3
auto_generated: true
-->

`apiVersion: authentication.k8s.io/v1`

`import "k8s.io/api/authentication/v1"`

<!--
## TokenReview {#TokenReview}

TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.
-->
## TokenReview {#TokenReview}

TokenReview 尝试通过验证令牌来确认已知用户。
注意：TokenReview 请求可能会被 kube-apiserver 中的 Webhook 令牌验证器插件缓存。

<hr>

- **apiVersion**: authentication.k8s.io/v1

- **kind**: TokenReview

- **metadata** (<a href="{{< ref "../common-definitions/object-meta#ObjectMeta" >}}">ObjectMeta</a>)

  <!--
  metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  -->
  
  `metadata` 是标准对象的元数据，更多信息：
  https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

<!--
- **spec** (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReviewSpec" >}}">TokenReviewSpec</a>), required

  spec holds information about the request being evaluated
-->
- **spec** (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReviewSpec" >}}">TokenReviewSpec</a>)，必需
  
  `spec` 保存有关正在评估的请求的信息

- **status** (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReviewStatus" >}}">TokenReviewStatus</a>)

  <!--
  status is filled in by the server and indicates whether the request can be authenticated.
  -->
  
  `status` 由服务器填写，指示请求是否可以通过身份验证。

## TokenReviewSpec {#TokenReviewSpec}

<!--
TokenReviewSpec is a description of the token authentication request.
-->
TokenReviewPec 是对令牌身份验证请求的描述。

<hr>

- **token** (string)

  <!--
  Token is the opaque bearer token.
  -->
  
  `token` 是不透明的持有者令牌（Bearer Token）。

- **audiences** ([]string)

  <!--
  *Atomic: will be replaced during a merge*
  
  audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.
  -->
  
  **原子性：将在合并期间被替换**

  `audiences` 是带有令牌的资源服务器标识为受众的标识符列表。
  受众感知令牌身份验证器将验证令牌是否适用于此列表中的至少一个受众。
  如果未提供受众，受众将默认为 Kubernetes API 服务器的受众。

## TokenReviewStatus {#TokenReviewStatus}

<!--
TokenReviewStatus is the result of the token authentication request.
-->
TokenReviewStatus 是令牌认证请求的结果。

<hr>

- **audiences** ([]string)

  <!--
  *Atomic: will be replaced during a merge*
  
  audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is "true", the token is valid against the audience of the Kubernetes API server.
  -->

  **原子性：将在合并期间被替换**

  `audiences` 是身份验证者选择的与 TokenReview 和令牌兼容的受众标识符。标识符是
  TokenReviewSpec 受众和令牌受众的交集中的任何标识符。设置 `spec.audiences`
  字段的 TokenReview API 的客户端应验证在 `status.audiences` 字段中返回了兼容的受众标识符，
  以确保 TokenReview 服务器能够识别受众。如果 TokenReview
  返回一个空的 `status.audience` 字段，其中 `status.authenticated` 为 “true”，
  则该令牌对 Kubernetes API 服务器的受众有效。

- **authenticated** (boolean)

  <!--
  authenticated indicates that the token was associated with a known user.
  -->
  
  `authenticated` 表示令牌与已知用户相关联。

- **error** (string)

  <!--
  error indicates that the token couldn't be checked
  -->
  
  `error` 表示无法检查令牌

- **user** (UserInfo)

  <!--
  user is the UserInfo associated with the provided token.
  -->
  
  `user` 是与提供的令牌关联的 UserInfo。

  <a name="UserInfo"></a>
  <!--
  *UserInfo holds the information about the user needed to implement the user.Info interface.*
  -->
  
  **UserInfo 保存实现 `user.Info` 接口所需的用户信息**

  - **user.extra** (map[string][]string)

    <!--
    extra is any additional information provided by the authenticator.
    -->
    
    `extra` 是验证者提供的任何附加信息。

  - **user.groups** ([]string)

    <!--
    Atomic: will be replaced during a merg
    -->
    
    **原子性：将在合并期间被替换**

    <!--
    groups is the names of groups this user is a part of.
    -->
    
    `groups` 是此用户所属的组的名称。

  - **user.uid** (string)

    <!--
    uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.
    -->
    
    `uid` 是跨时间标识此用户的唯一值。如果删除此用户并添加另一个同名用户，他们将拥有不同的 UID。

  - **user.username** (string)

    <!--
    username is the name that uniquely identifies this user among all active users.
    -->
    
    `username` 是在所有活跃用户中唯一标识此用户的名称。

<!--
## Operations {#Operations}
-->
## 操作 {#Operations}

<hr>

<!--
### `create` create a TokenReview

#### HTTP Request
-->
### `create` 创建一个TokenReview

#### HTTP 请求

POST /apis/authentication.k8s.io/v1/tokenreviews

<!--
#### Parameters

- **body**: <a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>, required
-->
#### 参数

- **body**: <a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>，必需

- **dryRun** (*in query*): string

  <a href="{{< ref "../common-parameters/common-parameters#dryRun" >}}">dryRun</a>

- **fieldManager** (*in query*): string

  <a href="{{< ref "../common-parameters/common-parameters#fieldManager" >}}">fieldManager</a>

- **fieldValidation** (*in query*): string

  <a href="{{< ref "../common-parameters/common-parameters#fieldValidation" >}}">fieldValidation</a>

- **pretty** (*in query*): string

  <a href="{{< ref "../common-parameters/common-parameters#pretty" >}}">pretty</a>

<!--
#### Response
-->
#### 响应

200 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): OK

201 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): Created

202 (<a href="{{< ref "../authentication-resources/token-review-v1#TokenReview" >}}">TokenReview</a>): Accepted

401: Unauthorized